Description

A vulnerability was found in code-projects Human Resource Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /views/admin/liveEventHistory.php of the component Live Event History. The manipulation of the argument eventSubject results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-10-05T05:17:02.660Z",
  "pubdate": "2026-10-05T05:17:02.660Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists within the Human Resource Management System 1.0, specifically impacting the Live Event History component.\nThe vulnerability is located in the /views/admin/liveEventHistory.php file and is triggered via improper sanitization of the eventSubject argument.\nThis flaw allows remote, unauthenticated or authenticated attackers (depending on access to the admin interface) to inject malicious scripts into the web application's response.\nWhen a user or administrator interacts with the manipulated URL, the injected script executes within the context of their session, potentially leading to unauthorized data access, session hijacking, or defacement.\nThe risk is elevated due to the public availability of an exploit, necessitating immediate remediation to prevent exploitation.",
  "technicalDetails": "The vulnerability is a classic Reflected Cross-Site Scripting (XSS) flaw occurring due to the application's failure to properly sanitize, validate, or encode user-supplied input before reflecting it back to the end-user's browser.\nThe specific injection vector is the eventSubject parameter within the /views/admin/liveEventHistory.php file. The application accepts the value of this parameter and embeds it directly into the HTML response document rendered for the user.\nThe attack flow begins when an attacker crafts a malicious URL containing a JavaScript payload within the eventSubject argument. For instance, an attacker could provide an input such as <script>alert('XSS')</script> or other event handlers like onload or onerror, often obfuscated to bypass basic filters.\nOnce the victim accesses this crafted URL, the server processes the input and returns an HTTP response containing the unencoded, malicious payload. The victim's browser, interpreting the server's response, treats the payload as legitimate script content belonging to the application's origin.\nBecause the execution happens within the browser of the victim, the script inherits the application's privileges. This allows the attacker to perform actions on behalf of the victim, such as stealing session cookies, capturing sensitive information displayed on the page, or redirecting the user to malicious sites.\nThe vulnerability resides in the server-side code of the Live Event History component, which fails to employ context-aware output encoding. Since the output is reflected inside an HTML context, the application should have ensured that all special characters are converted to their corresponding HTML entities (e.g., converting '<' to '&lt;' and '>' to '&gt;') before rendering.\nAs the exploit is publicly disclosed, the barrier to entry for potential attackers is significantly lowered, allowing even low-skilled threat actors to weaponize the vulnerability against deployed instances of Human Resource Management System 1.0."
}