Is there a public PoC exploit available for CVE-2026-12129?

Yes, a public proof-of-concept exploit is available for CVE-2026-12129. Prioritise patching immediately. EPSS: 0.0%.

CodeAstro HRMS CVE-2026-12129

Q: What is the CVSS score of CVE-2026-12129?

CVE-2026-12129 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-36562 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-06-12 VulDB

GHSA-ppff-2mf4-jfqq

XSS Human Resource Management System Codeastro

2.0

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.0 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network-accessible stored XSS requiring low-privilege auth and victim page-load; scope changes as script runs in victim's browser context with low C and I impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 12, 2026 - 21:38 vuln.today

Severity Changed

Jun 12, 2026 - 21:22 NVD

MEDIUM LOW

CVSS changed

Jun 12, 2026 - 21:22 NVD

5.1 (MEDIUM) 2.0 (LOW)

DescriptionCVE.org

A vulnerability was identified in CodeAstro Human Resource Management System 1.0. Affected by this issue is some unknown functionality of the file /dashboard/add_tod of the component Dashboard Interface. The manipulation of the argument todo_data leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly available and might be used.

AnalysisAI

Stored cross-site scripting in CodeAstro Human Resource Management System 1.0 allows an authenticated remote attacker to inject persistent malicious scripts via the todo_data parameter at the /dashboard/add_tod endpoint. When a higher-privileged user subsequently views the to-do list in the dashboard, the stored payload executes silently in their browser context, enabling session hijacking or unauthorized privileged actions. A public proof-of-concept exploit is available on GitHub; no CISA KEV listing exists at time of analysis, but the low barrier to exploitation for any authenticated user elevates practical risk above the CVSS 4.0 score of 2.0 implies.

Technical ContextAI

The affected component is the Dashboard Interface to-do feature of CodeAstro Human Resource Management System 1.0, identified by CPE cpe:2.3:a:codeastro:human_resource_management_system:*:*:*:*:*:*:*:*. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting): the application fails to sanitize or HTML-encode user-supplied input in the todo_data POST parameter before persisting it to the database and re-rendering it in the dashboard UI. The POC repository title 'Stored-XSS-via-TO-DO-LIST' confirms this is persistent (stored) XSS rather than reflected XSS, meaning the payload survives across sessions and targets any user who loads the to-do view - not just the submitter. This distinction materially increases risk over reflected XSS because exploitation does not require tricking a victim into clicking a crafted link; the payload lies dormant in the application until a privileged user naturally browses to the dashboard.

RemediationAI

No vendor-released patch has been identified at time of analysis. The primary fix requires the CodeAstro maintainers to apply output encoding (HTML entity encoding) to the todo_data field before rendering it in the dashboard, and input validation server-side to reject or sanitize script-bearing payloads on submission to /dashboard/add_tod. Deployers should monitor the VulDB advisory at https://vuldb.com/vuln/370614 and the vendor site at https://codeastro.com/ for an official patch release. As immediate compensating controls: implement a strict Content Security Policy (CSP) header that disallows inline scripts - note this may break legitimate dynamic functionality if the application relies on inline JavaScript, so testing is required before deployment. Deploy a Web Application Firewall rule to detect and block common XSS patterns (e.g., <script>, onerror=, javascript: sequences) in the todo_data parameter. Restrict dashboard access to the minimum set of necessary personnel, reducing the attack surface for stored payload delivery. Review existing to-do list entries for injected payloads and purge any suspicious content from the database immediately.