| Title | code-projects Human Resource Management In PHP 1.0 Cross Site Scripting |
|---|
| Description | The Human Resource Management System in PHP is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the event creation functionality.
The vulnerability occurs when the application processes user-controlled input supplied through the eventSubject parameter and stores the submitted value through the following component:
/humanresourcemanagementsystem/src/store/EventStore.php The application accepts attacker-controlled input containing HTML markup. If the submitted value is stored and subsequently rendered within the application interface without proper context-aware output encoding, an attacker can inject malicious HTML or JavaScript-capable markup that executes in the browser of users viewing the affected event.
Testing confirmed that the following payload could be submitted through the eventSubject parameter:
<details/open/ontoggle=prompt(origin)> Because the malicious value is stored server-side and can execute when the affected content is subsequently rendered, the vulnerability is classified as a Stored (Persistent) Cross-Site Scripting vulnerability.
An attacker with access to the event creation functionality could potentially exploit this issue to execute arbitrary JavaScript in the browser of other users who view the malicious event. |
|---|
| Source | ⚠️ https://github.com/ahmad-masa100/CVEsmasa100/blob/main/Stored%20Cross-Site%20Scripting%20(XSS)%20in%20Human%20Resource%20Management%20System%20in%20PHP.md |
|---|
| User | ahmad-masa10 (UID 101137) |
|---|
| Submission | 09/09/2026 18:17 (26 days ago) |
|---|
| Moderation | 10/04/2026 10:34 (25 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 413405 [code-projects Human Resource Management 1.0 Event Creation EventStore.php eventSubject cross site scripting] |
|---|
| Points | 20 |
|---|