Wukong_HRM vulnerabilities
CVEs whose affected-version data names the Wukong_HRM package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-108708High· 8.8PoCWukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees
Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privile…
▾ MidnightWuKongOpenSource · Wukong_HRMEPSS 0.28%via NVD
CVE-2026-108707Critical· 9.8PoCWukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header
Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator acce…
▾ AbyssalWuKongOpenSource · Wukong_HRMEPSS 0.55%via NVD