ByteOS Network

CVE Vulnerability Details :

CVE-2026-12130

PUBLISHED

More Info Official Page

Assigner-VulDB

Assigner Org ID-1af790b2-7ee1-4545-860a-a788eba489b5

Published At-12 Jun, 2026 | 20:45

Updated At-12 Jun, 2026 | 20:45

▼CVE Numbering Authority (CNA)

CodeAstro Human Resource Management System Projects Management Add_Projects cross site scripting

A security flaw has been discovered in CodeAstro Human Resource Management System 1.0. This affects an unknown part of the file /Projects/Add_Projects of the component Projects Management Page. The manipulation of the argument protitle results in cross site scripting. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

Affected Products

Vendor

CodeAstro

Product

Human Resource Management System

CPEs

cpe:2.3:a:codeastro:human_resource_management_system:*:*:*:*:*:*:*:*

Modules

Projects Management Page

Versions

Affected

Problem Types

Type	CWE ID	Description
CWE	CWE-79	Cross Site Scripting
CWE	CWE-94	Code Injection

Type: CWE

CWE ID: CWE-79

Description: Cross Site Scripting

Type: CWE

CWE ID: CWE-94

Description: Code Injection

Metrics

Version	Base score	Base severity	Vector
4.0	5.1	MEDIUM	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
3.1	3.5	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
3.0	3.5	LOW	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
2.0	4.0	N/A	AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR

Version: 4.0

Base score: 5.1

Base severity: MEDIUM

Vector:

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

Version: 3.1

Base score: 3.5

Base severity: LOW

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

Version: 3.0

Base score: 3.5

Base severity: LOW

Vector:

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

Version: 2.0

Base score: 4.0

Base severity: N/A

Vector:

AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR

Credits

reporter

ashikmd7 (VulDB User)

Timeline

Event	Date
Advisory disclosed	2026-06-12 00:00:00
VulDB entry created	2026-06-12 02:00:00
VulDB entry last update	2026-06-12 17:26:15

Event: Advisory disclosed

Date: 2026-06-12 00:00:00

Event: VulDB entry created

Date: 2026-06-12 02:00:00

Event: VulDB entry last update

Date: 2026-06-12 17:26:15

References

Hyperlink	Resource
https://vuldb.com/vuln/370615	vdb-entry technical-description
https://vuldb.com/vuln/370615/cti	signature permissions-required
https://vuldb.com/cve/CVE-2026-12130	third-party-advisory
https://vuldb.com/submit/837202	third-party-advisory
https://github.com/ashikmd0507/CVE/tree/main/Stored-XSS-via-Project-Title	exploit
https://codeastro.com/	product