CVE-2013-2498: SQL injection vulnerability in the login page in flexycms/modules/user/user_manager.php in SimpleHRM 2.3, 2...

Security readout for executives and security teams

This CVE describes a SQL injection flaw in the SimpleHRM login flow. If an affected SimpleHRM 2.3, 2.2, or earlier system is reachable, an unauthenticated remote attacker may be able to run database commands through the login username field. Exposure is limited to organizations still running SimpleHRM 2.3, 2.2, or earlier. Internet-facing or partner-accessible login pages would be the highest concern. Modern environments are unlikely to be exposed unless this legacy HRM application remains deployed. Prioritize remediation if SimpleHRM is still in use, especially on an externally reachable HR or employee system. The likely business risk is database compromise from an old unauthenticated login flaw, but urgency depends on whether the legacy application exists in the environment. Mitigation focus: Inventory systems for SimpleHRM 2.3, 2.2, or earlier.; Check vendor or maintainer guidance for a fixed release or retirement path.; Remove or replace unsupported SimpleHRM deployments where feasible..

Prepared

Jun 14, 2026, 14:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.