Hr Payroll Management System
Monthly
Cross-site scripting in the chat.php endpoint of Saruf-Ratul's HR-Payroll-Management-System allows an attacker to inject script through the ID argument, with execution occurring in a logged-in victim's browser after that user is induced to open a crafted request or link. The flaw is remotely reachable but requires a low-privileged authenticated session (PR:L) plus victim interaction (UI:P), and the assessed impact is limited to script execution in the victim's browser context with no confidentiality or availability impact as scored. A public PoC reference exists in the project's issue tracker; it is not verified as working exploit code, CISA KEV does not list the product, EPSS is 0.20% (10th percentile), SSVC rates exploitation as 'poc' with partial technical impact, and the tracking decision is monitor.
Cross-site scripting in the chat.php endpoint of Saruf-Ratul's HR-Payroll-Management-System allows an attacker to inject script through the ID argument, with execution occurring in a logged-in victim's browser after that user is induced to open a crafted request or link. The flaw is remotely reachable but requires a low-privileged authenticated session (PR:L) plus victim interaction (UI:P), and the assessed impact is limited to script execution in the victim's browser context with no confidentiality or availability impact as scored. A public PoC reference exists in the project's issue tracker; it is not verified as working exploit code, CISA KEV does not list the product, EPSS is 0.20% (10th percentile), SSVC rates exploitation as 'poc' with partial technical impact, and the tracking decision is monitor.