CVE-2022-40435

35th percentile - higher than 35% of all known CVEs

Employee Performance Evaluation System v1.0 was found to have a persistent cross-site scripting (XSS) vulnerability in the Departments and Designations module. An attacker can inject malicious scripts when adding new entries.

The risk involves execution of arbitrary JavaScript in other users' browsers, potentially leading to session theft, data modification, or further attacks on the organization.

Update the system to the latest version or implement input filtering and encoding in the Departments and Designations module. Also consider deploying a Content Security Policy (CSP).