CodeAstro HRMS CVE-2026-12129

Exploitation requires the attacker to possess a valid authenticated session with at least low-privilege access to the CodeAstro HRMS dashboard (PR:L per the CVSS 4.0 vector), sufficient to submit entries to the to-do feature via the /dashboard/add_tod endpoint. The stored payload only executes when a second user with dashboard access passively loads the to-do list view containing the injected entry (UI:P per CVSS 4.0). Exploitation is limited by: (1) the requirement that the attacker first obtain authenticated credentials - unauthenticated external exploitation is not possible; (2) the necessity that a victim user, ideally one with elevated privileges, subsequently and naturally navigates to the to-do list view; and (3) the application must be accessible over a network path from the attacker. No non-default configuration is required beyond authenticated access and the dashboard to-do feature being in use. The attack does not require any special tool beyond a web browser or curl-equivalent capable of submitting the crafted POST request.

The CVSS 4.0 score of 2.0 reflects constrained base metrics: low-privilege authentication (PR:L), passive victim interaction (UI:P), and only low integrity impact on the vulnerable system (VI:L) with no confidentiality or availability impact scored against the vulnerable system itself. EPSS data was not provided, and the vulnerability is absent from the CISA KEV catalog, indicating no confirmed widespread active exploitation. However, a public POC exists on GitHub (E:P in the CVSS threat component), which reduces the skill threshold for exploitation to near zero for anyone who holds a valid account. The stored persistence of the payload meaningfully elevates practical risk: a single injection from a low-privilege employee account can target every privileged administrator who loads the dashboard, without any further attacker interaction. For HRM systems - which typically store sensitive employee PII, payroll data, and HR workflows - administrative session compromise could cascade into a broader breach. The CVSS 4.0 score arguably understates subsequent-system confidentiality impact (SC:N) given that stored XSS commonly enables session token theft affecting the victim's authenticated context. Overall: low urgency for patching on isolated, internally-accessible deployments, but elevated priority where the HRMS is internet-exposed or shares authentication with other internal systems.

An authenticated low-privilege employee accesses the CodeAstro HRMS dashboard and submits a to-do item via /dashboard/add_tod with a JavaScript payload (e.g., a cookie-stealing document.cookie exfiltration script) embedded in the todo_data field. The application stores the unsanitized payload in the database without encoding. When an HR administrator later opens the dashboard and the to-do list renders, the payload executes in the admin's browser, silently transmitting their session token to an attacker-controlled endpoint. A public POC demonstrating this exact technique is available at https://github.com/ashikmd0507/CVE/tree/main/Stored-XSS-via-TO-DO-LIST, making exploitation accessible to low-skill attackers.