Human Resource Management
Monthly
Stored cross-site scripting (XSS) in code-projects Human Resource Management 1.0 lets an authenticated, low-privileged user inject arbitrary JavaScript through the eventSubject argument handled by /humanresourcemanagementsystem/src/store/EventStore.php, which then executes in the browser of any user who views the affected event. Exploitation requires an account able to reach the Event Creation feature plus a victim who renders the malicious event (UI:P), and publicly available exploit code exists; there is no confirmed active exploitation (not in CISA KEV). Independent assessment rates real-world risk as low because of the authentication prerequisite, the dependence on victim interaction, the scope change toward other users in the same origin, and the very small deployment base of this product.
Insecure Direct Object Reference (IDOR) in SourceCodester Human Resource Management 1.0 allows authenticated remote attackers to read other employees' records by manipulating the `employeeid` parameter in `/detailview.php`. The vulnerability results in unauthorized disclosure of employee data across account boundaries, with no integrity or availability impact. A publicly available proof-of-concept exploit exists; no active exploitation has been confirmed by CISA KEV at time of analysis.
A vulnerability was found in code-projects Human Resource Management System 1.0.1. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Human Resource Management System 1.0.1 and classified as critical.go. Rated medium severity (CVSS 5.1), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Stored cross-site scripting (XSS) in code-projects Human Resource Management 1.0 lets an authenticated, low-privileged user inject arbitrary JavaScript through the eventSubject argument handled by /humanresourcemanagementsystem/src/store/EventStore.php, which then executes in the browser of any user who views the affected event. Exploitation requires an account able to reach the Event Creation feature plus a victim who renders the malicious event (UI:P), and publicly available exploit code exists; there is no confirmed active exploitation (not in CISA KEV). Independent assessment rates real-world risk as low because of the authentication prerequisite, the dependence on victim interaction, the scope change toward other users in the same origin, and the very small deployment base of this product.
Insecure Direct Object Reference (IDOR) in SourceCodester Human Resource Management 1.0 allows authenticated remote attackers to read other employees' records by manipulating the `employeeid` parameter in `/detailview.php`. The vulnerability results in unauthorized disclosure of employee data across account boundaries, with no integrity or availability impact. A publicly available proof-of-concept exploit exists; no active exploitation has been confirmed by CISA KEV at time of analysis.
A vulnerability was found in code-projects Human Resource Management System 1.0.1. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Human Resource Management System 1.0.1 and classified as critical.go. Rated medium severity (CVSS 5.1), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.