CVE Intelligence

SIMAC vulnerabilities

🔔 Create alert RSS

Published CVEs affecting SIMAC products: 1 record(s), with severity, exploitation and fixes.

MyPHR 1

Exploited only (KEV) →

CVE-2026-47094 High · 8.8 CWE-639 Sep 16, 2026
SIMAC MyPHR 1.1 IDOR Account Takeover via /api/employes/put/{id}
SIMAC MyPHR 1.1 contains an insecure direct object reference (IDOR) vulnerability that allows authenticated attackers to access and modify arbitrary employee records due to missing server-side ownership validation. Attackers can send a PUT request to the employee update endpoint with an arbitrary employee identifier and a controlled password value to take over target accounts, enumerate employee records, and retrieve sensitive personally identifiable information including private pay bulletins.