Vulnerability-Lookup

CNVD-2026-34867

Vulnerability from cnvd - Published: 2026-08-27

Title

Human Resource Management System跨站脚本漏洞（CNVD-2026-34867）

Description

Human Resource Management System是CodeAstro公司的企业人力资源管理软件。 Human Resource Management System存在跨站脚本漏洞，该漏洞源于未能正确过滤/notice/All_notice文件中Notice Title参数中的输入，目前没有详细的漏洞细节提供。

Severity

低

Formal description

目前厂商尚未发布升级程序修复该安全问题，详情见厂商官网： https://codeastro.com/

Reference

https://vuldb.com/vuln/369111

Impacted products

Name
Human Resource Management System Human Resource Management System v1.0

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2026-11491",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-11491"
    }
  },
  "description": "Human Resource Management System\u662fCodeAstro\u516c\u53f8\u7684\u4f01\u4e1a\u4eba\u529b\u8d44\u6e90\u7ba1\u7406\u8f6f\u4ef6\u3002\n\nHuman Resource Management System\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u672a\u80fd\u6b63\u786e\u8fc7\u6ee4/notice/All_notice\u6587\u4ef6\u4e2dNotice Title\u53c2\u6570\u4e2d\u7684\u8f93\u5165\uff0c\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5c1a\u672a\u53d1\u5e03\u5347\u7ea7\u7a0b\u5e8f\u4fee\u590d\u8be5\u5b89\u5168\u95ee\u9898\uff0c\u8be6\u60c5\u89c1\u5382\u5546\u5b98\u7f51\uff1a\r\nhttps://codeastro.com/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2026-34867",
  "openTime": "2026-08-27",
  "products": {
    "product": "Human Resource Management System Human Resource Management System v1.0"
  },
  "referenceLink": "https://vuldb.com/vuln/369111",
  "serverity": "\u4f4e",
  "submitTime": "2026-06-09",
  "title": "Human Resource Management System\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff08CNVD-2026-34867\uff09"
}

CVE-2026-11491 (GCVE-0-2026-11491)

Vulnerability from cvelistv5 – Published: 2026-06-08 05:15 – Updated: 2026-06-08 16:32

Title

CodeAstro Human Resource Management System Notice Board Management All_notice cross site scripting

Summary

A vulnerability was identified in CodeAstro Human Resource Management System 1.0. Impacted is an unknown function of the file /notice/All_notice of the component Notice Board Management. Such manipulation of the argument Notice Title with the input <svg onload="alert('Stored XSS Triggered by Ashik Mohamed')"> as part of POST leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

Severity

4.8 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

2.4 (Low)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

2.4 (Low)


                        
                          CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-08 12:48 UTC

CWE

CWE-79 - Cross Site Scripting
CWE-94 - Code Injection

Assigner

VulDB mitre root Scorecard

References

6 references

URL	Tags
https://vuldb.com/vuln/369111	vdb-entrytechnical-description
https://vuldb.com/vuln/369111/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-11491	third-party-advisory
https://vuldb.com/submit/834747	third-party-advisory
https://github.com/ashikmd0507/CVE/blob/main/CVE-…	exploit
https://codeastro.com/	product

Impacted products

1 product

Vendor	Product	Version
CodeAstro	Human Resource Management System	Affected: 1.0 cpe:2.3:a:codeastro:human_resource_management_system::::::::

Credits

Ashik Mohamed ashikmd7 (VulDB User) ashikmd7 (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-11491",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-08T12:48:19.181226Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-08T16:32:27.215Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:codeastro:human_resource_management_system:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Notice Board Management"
          ],
          "product": "Human Resource Management System",
          "vendor": "CodeAstro",
          "versions": [
            {
              "status": "affected",
              "version": "1.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ashik Mohamed"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "ashikmd7 (VulDB User)"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "ashikmd7 (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was identified in CodeAstro Human Resource Management System 1.0. Impacted is an unknown function of the file /notice/All_notice of the component Notice Board Management. Such manipulation of the argument Notice Title with the input \u003csvg onload=\"alert(\u0027Stored XSS Triggered by Ashik Mohamed\u0027)\"\u003e as part of POST leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 2.4,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 2.4,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 3.3,
            "vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Cross Site Scripting",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "Code Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-08T05:15:08.023Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-369111 | CodeAstro Human Resource Management System Notice Board Management All_notice cross site scripting",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/369111"
        },
        {
          "name": "VDB-369111 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/369111/cti"
        },
        {
          "name": "CVE-2026-11491 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-11491"
        },
        {
          "name": "Submit #834747 | CodeAstro Human Resource Management System in PHP CodeIgniter 1.0 Cross Site Scripting",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/834747"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/ashikmd0507/CVE/blob/main/CVE-2026-11491/README.md"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://codeastro.com/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-07T00:00:00.000Z",
          "value": "Vendor acknowledged"
        },
        {
          "lang": "en",
          "time": "2026-06-07T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-06-07T00:00:00.000Z",
          "value": "Exploit disclosed"
        },
        {
          "lang": "en",
          "time": "2026-06-07T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-06-07T15:33:27.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "CodeAstro Human Resource Management System Notice Board Management All_notice cross site scripting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-11491",
    "datePublished": "2026-06-08T05:15:08.023Z",
    "dateReserved": "2026-06-07T10:13:37.591Z",
    "dateUpdated": "2026-06-08T16:32:27.215Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CNVD-2026-34867

CVE-2026-11491 (GCVE-0-2026-11491)

Tags

Sightings

Nomenclature

Related by attack behaviour