CVE-2025-51506 is a SQL injection vulnerability found in the smartLibrary component of HRForecast Suite 0.4.3, specifically affecting the talentneuron hrforecast_suite product. This medium-severity flaw (CVSS 6.5) allows any authenticated user to execute arbitrary SQL queries by sending crafted payloads to the valueKey parameter at the api/smartlibrary/v2/en/dictionaries/options/lookup endpoint. While the vulnerability has a relatively high FAUCET Risk Score of 62/100, there is currently no evidence of active exploitation, exploit code availability (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
0.4.3CPE matchmatch criteria | cpe:2.3:a:talentneuron:hrforecast_suite:0.4.3:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.