CVE-2025-63294

WorkDo HRM SaaS HR and Payroll Tool 8.1 is affected vulnerable to Insecure Permissions. An authenticated user can create leave or resignation records on behalf of other users.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://codecanyon.net/item/hrm-saas-hr-and-payroll-tool/25982934	Product
https://medium.com/@barrattjack89/cve-2025-63294-insecure-permissions-in-workdo-hrm-saas-hr-and-payroll-8-1-d6bb03c21177	Exploit Third Party Advisory
https://workdo.io/hrm-saas-human-resource-management-software/	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:workdo:hrm_saas:8.1:*:*:*:*:*:*:*

History

05 Nov 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) La Herramienta de RRHH y Nómina SaaS WorkDo HRM 8.1 está afectada, vulnerable a Permisos Inseguros. Un usuario autenticado puede crear registros de licencia o renuncia en nombre de otros usuarios.

Information

Published : 2025-11-04 16:16

Updated : 2026-11-05 22:10

NVD link : CVE-2025-63294

Mitre link : CVE-2025-63294

CVE.ORG link : CVE-2025-63294

JSON object : View

Products Affected

workdo

hrm_saas

CWE

CWE-862

Missing Authorization

{"id": "CVE-2025-63294", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-63294", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-04T15:49:34.232021Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-11-04T16:16:01.090", "references": [{"url": "https://codecanyon.net/item/hrm-saas-hr-and-payroll-tool/25982934", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://medium.com/@barrattjack89/cve-2025-63294-insecure-permissions-in-workdo-hrm-saas-hr-and-payroll-8-1-d6bb03c21177", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://workdo.io/hrm-saas-human-resource-management-software/", "tags": ["Product"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "WorkDo HRM SaaS HR and Payroll Tool 8.1 is affected vulnerable to Insecure Permissions. An authenticated user can create leave or resignation records on behalf of other users."}, {"lang": "es", "value": "La Herramienta de RRHH y N\u00f3mina SaaS WorkDo HRM 8.1 est\u00e1 afectada, vulnerable a Permisos Inseguros. Un usuario autenticado puede crear registros de licencia o renuncia en nombre de otros usuarios."}], "lastModified": "2026-11-05T22:10:00.203", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:workdo:hrm_saas:8.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F2CA5F3C-FF7E-4ED7-8791-B57144BB6F27"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}