code-projects HRMS CVE-2026-105188

Exploitation requires an authenticated session with access to the admin interface (PR:L) because the vulnerable endpoint /views/admin/liveEventHistory.php resides in the admin area, and it requires passive interaction from a victim user (UI:P) who must load the page where the injected eventSubject value is rendered. The specific prerequisite is the ability to supply attacker-controlled input to the eventSubject argument of the Live Event History component. Limiting factors that reduce realistic risk: the attacker must first obtain valid admin-area credentials/access, a separate victim must view the affected page for the payload to fire, impact is confined to script execution in the browser (integrity-only, no confidentiality or availability loss), and the affected product is code-projects Human Resource Management System 1.0 specifically.

This is a low-to-moderate real-world risk that scores higher on paper than in practice. The CVSS 4.0 base score of 5.1 (Medium) reflects a network-reachable (AV:N) cross-site scripting flaw with low attack complexity (AC:L), but it is gated by two meaningful factors that the raw score partially discounts: it requires an authenticated user (PR:L) and passive victim interaction (UI:P), and its impact is limited to low integrity (VI:L) with no confidentiality or availability impact (VC:N/VA:N) and no scope change to other systems (SC:N/SI:N/SA:N). A public exploit exists (POC=YES, VulDB-referenced GitHub attachment) and the SSVC/CVSS exploit maturity is Proof-of-Concept (E:P), but there is NO CISA KEV listing and no evidence of active exploitation - so this is 'publicly available exploit code exists', not active exploitation. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be factored in and is UNKNOWN. The dominant risk-reducing signal is prevalence: code-projects HRMS 1.0 is a small educational/hobby PHP application with negligible production deployment, so despite a working PoC this is not a widespread-exploitation priority. Treat it as a routine low-priority web application XSS rather than an urgent threat.

An authenticated attacker with access to the HRMS admin area submits a crafted value in the eventSubject argument of /views/admin/liveEventHistory.php, injecting a JavaScript payload into the Live Event History component. When another admin user subsequently views the affected page, the stored/reflected script executes in their browser session. A public proof-of-concept for this injection is already available.