Is there a public PoC exploit available for CVE-2026-11491?

Yes, a public proof-of-concept exploit is available for CVE-2026-11491. Prioritise patching immediately. EPSS: 0.0%.

CodeAstro HRMS CVE-2026-11491

Q: What is the CVSS score of CVE-2026-11491?

CVE-2026-11491 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35022 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-06-08 VulDB

GHSA-2hp8-8xwj-c2gv

XSS Human Resource Management System Codeastro

1.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.9 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Jun 08, 2026 - 07:22 NVD

2.4 (LOW) 1.9 (LOW)

Analysis Generated

Jun 08, 2026 - 06:53 vuln.today

DescriptionCVE.org

A vulnerability was identified in CodeAstro Human Resource Management System 1.0. Impacted is an unknown function of the file /notice/All_notice of the component Notice Board Management. Such manipulation of the argument Notice Title with the input <svg onload="alert('Stored XSS Triggered by Ashik Mohamed')"> as part of POST leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

AnalysisAI

Stored cross-site scripting in CodeAstro Human Resource Management System 1.0 enables a high-privileged authenticated attacker to inject persistent malicious script via the Notice Title parameter in the Notice Board Management component, executing in the browsers of any user who subsequently views the affected notice. The publicly available proof-of-concept on GitHub demonstrates exploitation via an SVG onload payload submitted through a POST request to /notice/All_notice. Despite remote accessibility, real-world severity is constrained by the requirement for prior high-privilege authentication and the need for victim interaction - reflected in the low CVSS score of 2.4 - and no public exploitation campaign has been identified at time of analysis.

Technical ContextAI

The vulnerability resides in the Notice Board Management module of CodeAstro Human Resource Management System, accessible at the /notice/All_notice endpoint. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: user-supplied input in the Notice Title field is accepted via HTTP POST and stored server-side without adequate sanitization or output encoding. When a victim subsequently loads the notice listing page, the unsanitized payload is rendered in the browser DOM context, allowing execution of arbitrary JavaScript. The demonstrated payload uses an SVG element with an onload event handler - a common technique for bypassing naive keyword-based filters that block classic script tags. The CPE string cpe:2.3:a:codeastro:human_resource_management_system:*:*:*:*:*:*:*:* uses a wildcard version component, suggesting NVD has not confirmed a specific fixed version upper bound, though the description specifies version 1.0 as the tested affected release.

RemediationAI

No vendor-released patch has been identified at time of analysis; the VulDB references and codeastro.com vendor site do not link to a security advisory or fixed release. Organizations should contact CodeAstro directly to request a patched version. As a compensating control, restrict access to the /notice/All_notice endpoint and the Notice Board Management feature to the minimum required set of privileged users, which reduces the pool of accounts that could introduce malicious payloads (trade-off: limits notice board functionality). Implement a Web Application Firewall rule to detect and block SVG-based and JavaScript event handler payloads in POST body parameters targeting this endpoint; note that WAF rules can be bypassed by encoding variations and are not a substitute for server-side output encoding. Audit existing notice entries for unexpected HTML or script content. If the notice board feature is non-essential, disable it entirely until a patch is available. Monitor for the exploit proof-of-concept at https://github.com/ashikmd0507/CVE/blob/main/CVE-2026-11491/README.md to understand current payload variations.