⚠️Infor Global HR | Reflected Cross-Site Scripting (XSS) Disclosure

Discoverer: Paul Goodrich, Giovanni Heward, Adam Hainline, Tyler Gleave, Dan Gilbert

Tested v11.23.03.00.21 - Prior versions are affected.

Summary of Findings

• Cross-Site Scripting (XSS) - Reflected

  • CVE-2024-51423

• ​Insecure Direct Object Reference (IDOR)

  • CVE-2025-60931

Timeline

• Reported to Vendor: Oct 24th, 2024

• Patched: Jan, 2025

• Published: Sept 2, 2025