| शीर्षक | code-projects Human Resource Management System 1.0 Cross Site Scripting |
|---|
| विवरण | The Human Resource Management System in PHP is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the live event functionality.
The vulnerability occurs when attacker-controlled input is submitted through the eventSubject parameter and stored by the application through the event storage functionality. The malicious value is subsequently rendered in the live event history page:
/humanresourcemanagementsystem/views/admin/liveEventHistory.php
Testing confirmed that the following XSS payload could be stored and subsequently executed when the affected live event history page was viewed:
--><script>alert(123)</script>
The vulnerable request used to access the affected page is:
GET /humanresourcemanagementsystem/views/admin/liveEventHistory.php HTTP/1.1
Host: localhost
Because the malicious payload is stored server-side and later rendered in the application interface, this vulnerability is classified as a Stored (Persistent) Cross-Site Scripting vulnerability.
An attacker with access to the functionality that allows modification or creation of live events may inject malicious JavaScript that executes in the browser of users viewing the affected event history page. |
|---|
| स्रोत | ⚠️ https://github.com/user-attachments/assets/f4902bfb-fc8e-4e4c-8ef8-01fde7c51038 |
|---|
| उपयोगकर्ता | ahmad-masa10 (UID 101137) |
|---|
| सबमिशन | 10/09/2026 06:23 PM (24 दिन पहले) |
|---|
| संयम | 04/10/2026 11:39 AM (24 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 413425 [code-projects Human Resource Management System 1.0 Live Event History liveEventHistory.php eventSubject क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|