Human Resource Management CVE-2026-105173

Requires an authenticated account with at least low privileges (PR:L) capable of reaching the Event Creation feature and submitting the eventSubject argument handled by /humanresourcemanagementsystem/src/store/EventStore.php, plus subsequent victim interaction (UI:P) - a second user or administrator must view the stored event for the injected script to execute. Exploitation is limited by the authentication requirement, the dependency on a victim rendering the malicious event, and the extremely small real-world deployment base of this product; it is not exploitable pre-authentication or against a default install with no additional users.

This is a high-CVSS-but-low-real-risk issue for most organizations. The signals are internally consistent and modest: the official CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N) yields only 5.1 (Medium), reflecting a stored XSS that requires an authenticated low-privileged account (PR:L) plus victim interaction (UI:P) and produces only limited integrity impact (VI:L) with no confidentiality or availability loss per the vendor-neutral VulDB scoring. Public exploit code exists (confirmed via a GitHub write-up), but there is NO CISA KEV listing and NO EPSS score was provided in the input, so there is no evidence of active or automated exploitation - POC availability must not be conflated with in-the-wild use. The exploitation status (E:P) in the CVSS vector confirms only a proof-of-concept maturity, not functional weaponization. The dominant risk-limiting factor is the target product itself: code-projects Human Resource Management 1.0 is a small open-source/educational PHP application with negligible production footprint, so even a trivially exploitable flaw has limited blast radius. No conflicting signals were observed between the description (stored XSS via eventSubject) and the CVSS vector.

An authenticated low-privileged user of the HR Management System submits an Event Creation form and injects a malicious script into the eventSubject field, which is stored unsanitized by EventStore.php. When an administrator or another user later views the event, the stored payload executes in their browser, enabling session token theft or UI manipulation. A public proof-of-concept write-up for this stored XSS already exists on GitHub.