Is there a public PoC exploit available for CVE-2026-12130?

Yes, a public proof-of-concept exploit is available for CVE-2026-12130. Prioritise patching immediately. EPSS: 0.0%.

CodeAstro HRMS CVE-2026-12130

Q: What is the CVSS score of CVE-2026-12130?

CVE-2026-12130 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-36569 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-06-12 VulDB

GHSA-7746-xhm9-vvcw

XSS Human Resource Management System Codeastro

2.0

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.0 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network-delivered stored XSS requiring low-privilege auth (PR:L), victim page view (UI:R), scope change to victim browser (S:C), with low C and I for session/data exposure.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 12, 2026 - 21:37 vuln.today

Severity Changed

Jun 12, 2026 - 21:22 NVD

MEDIUM LOW

CVSS changed

Jun 12, 2026 - 21:22 NVD

5.1 (MEDIUM) 2.0 (LOW)

DescriptionCVE.org

A security flaw has been discovered in CodeAstro Human Resource Management System 1.0. This affects an unknown part of the file /Projects/Add_Projects of the component Projects Management Page. The manipulation of the argument protitle results in cross site scripting. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

Stored cross-site scripting in CodeAstro Human Resource Management System 1.0 allows an authenticated low-privilege user to inject persistent malicious script via the protitle argument on the /Projects/Add_Projects endpoint. When any other authenticated user (e.g., an HR administrator) subsequently views the Projects Management Page, the stored payload executes in their browser context, enabling session hijacking, credential theft, or unauthorized actions on their behalf. A public proof-of-concept exploit is hosted on GitHub, lowering the bar for exploitation, though KEV listing is absent and the CVSS 4.0 score of 2.0 reflects the constrained impact scope.

Technical ContextAI

The affected component is the Projects Management page of CodeAstro Human Resource Management System version 1.0 (CPE: cpe:2.3:a:codeastro:human_resource_management_system:*:*:*:*:*:*:*:*). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting): the application fails to sanitize or encode the protitle POST parameter before persisting it to the database and later rendering it back into HTML responses. Because the payload is stored server-side and rendered to any user who views the projects listing, this is classified as stored (persistent) XSS rather than reflected. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) confirms network delivery, no special attack conditions, low-privilege authentication required, and passive user interaction needed from the victim.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor site (https://codeastro.com/) was listed as a reference but contains no advisory. The upstream fix, if any, has not been independently confirmed with an exact version number. As an immediate compensating control, restrict access to the /Projects/Add_Projects endpoint to only fully trusted, vetted users - do not allow untrusted or externally-facing accounts the Projects Management privilege. Implement a Web Application Firewall (WAF) rule to detect and block XSS patterns (e.g., <script>, onerror=, javascript:) in the protitle POST parameter; note this is an imperfect filter and may produce false positives on legitimate project title input. Apply a strict Content-Security-Policy header (default-src 'self') to limit script execution scope, though this requires server configuration access. Monitor VulDB entry https://vuldb.com/cve/CVE-2026-12130 and the vendor site for patch availability. If a patched release is published, upgrade immediately and validate that the protitle field is properly HTML-encoded on output.