Description
WorkDo HRM SaaS HR and Payroll Tool 8.1 is affected vulnerable to Insecure Permissions. An authenticated user can create leave or resignation records on behalf of other users.
Affected products
workdo: hrm saas
References3
- medium.com/@barrattjack89/cve-2025-63294-insecure-permissions-i… ExploitThird Party Advisory
- codecanyon.net/item/hrm-saas-hr-and-payroll-tool/25982934 Product
- workdo.io/hrm-saas-human-resource-management-software/ Product
Metrics
- CVSS 3.1
-
6.5
MEDIUM
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - EPSS — exploit probability
- 0% percentile: 25 · as of 10 November 2026
- CWE
- CWE-862
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.