An issue in OrangeHRM v.5.7 allows an attacker to escalate privileges via UserService.php and the checkForOldHash function. Authentication decisions may be made via PHP loose-equality comparisons if a specific MD5 value is present in the credential store. NOTE: this is disputed by the Supplier because an adversary has no way to place the specific MD5 value into the credential store (unless they already have full privileges) and because the specific MD5 value would not realistically be present otherwise.
Conclusion & alert: CVE-2025-44040 is rated Moderate Risk (48.2/100): CVSS High severity, with medium exploitation likelihood (EPSS 0.32%). Mandatory action: Review affected assets and schedule remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-03-17 | 0.10% | 0.32% | +0.22% |
| 2 | 2025-11-21 | 0.16% | 0.10% | -0.06% |
| 3 | 2025-11-18 | — | 0.16% | — |
Full EPSS history (7 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 7.2 | 3.1 | HIGH |
|
1.2 | 5.9 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
| URL | Tags |
|---|---|
| https://github.com/hexomedin3/advisories/tree/main/CVE-2025-44040 | Third Party Advisory |
| https://github.com/orangehrm/orangehrm/releases/tag/v5.7 | Release Notes |