HR Payroll Management System EUVD-2026-110581

Exploitation targets the ID argument of chat.php in Saruf-Ratul's HR-Payroll-Management-System and requires a low-privileged authenticated session (PR:L) plus victim interaction (UI:P) - the attacker must get a logged-in user to open the crafted request/link, so this is not a drive-by against anonymous visitors. Impact is confined to script execution in the victim's browser context (limited integrity, no confidentiality or availability impact as scored). Limiting factors: valid authentication is needed, a victim must interact, and the affected product has essentially no production deployment. Because the project ships rolling releases and has not responded, no fixed version is available; the input lists only two affected commit hashes (e7cd81477001afdee95b843fd4137894d9418c9f and 3fd6f45ead9f8197510c0910f759e06ee67251e5).

This is a low-severity, low-priority issue despite being a 'published exploit' entry. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N) scores only 2.0, reflecting a reflected cross-site scripting flaw (CWE-79) that requires an already-authenticated low-privileged account (PR:L) and victim interaction (UI:P), with only limited integrity impact to the victim's browser session and no confidentiality or availability impact as scored by the reporter. All non-static signals agree on low urgency: EPSS is 0.20% (10th percentile), there is no CISA KEV listing, and the vuln.today Decision label is 'monitor'. SSVC aligns - exploitation state is only 'poc', Automatable is 'no', and Technical Impact is 'partial'. The one signal that could suggest urgency ('The exploit has been published') is tempered by the input, which marks the PoC as a reference only, not verified as working exploit code - the 'exploit' reference is simply a GitHub issue report. No signals conflict here; they consistently point to a genuine-but-minor web flaw rather than a real operational priority. The practical limiting factor is that this requires an authenticated session plus user interaction against an obscure application with negligible deployment, so real-world risk is marginal.

An attacker with a low-privileged authenticated account on the HR-Payroll-Management-System crafts a link to chat.php containing a malicious payload in the ID parameter and lures another logged-in user into opening it; the script then executes in that victim's browser session. A public PoC reference exists (a GitHub issue), but it is not verified as working exploit code, and exploitation still depends on victim interaction as indicated by UI:P.