Vulnerability Spotlight: SQL injection vulnerability in Glacies IceHRM

Summary: Cisco Talos researchers found an exploitable SQL injection vulnerability in the admin reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a). A specially crafted, authenticated HTTP request can trigger the injection and let an attacker access information such as usernames and password hashes stored in the software's database.
What's compelling: The flaw sits in an HR tool that holds payroll data and password hashes, and reaching it requires only an authenticated request - so a single compromised or low-privilege account could expose the credential material for the rest of the user base.

Read the original at Cisco Talos ↗

Topics: Cloud Security
Related: Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs Cyber Risks · Nov 12, 2026
New Falcon Cloud Security Innovations Secure the Cloud AI Runs On Cyber Risks · Nov 04, 2026
Cloud-Native Security in 2025: Why Runtime Visibility Must Take Center Stage Cyber Risks ·