CVE-2026-11491
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A stored XSS vulnerability was found in CodeAstro Human Resource Management System 1.0 in the Notice Board Management function. Manipulating the 'Notice Title' argument via POST with JavaScript code leads to script execution in the victim's browser.
Risk Assessment
An attacker can remotely execute malicious scripts in another user's session, potentially leading to session hijacking, account takeover, or further attacks.
Recommendation
Immediately update the system to a patched version or apply input filtering and output encoding for the 'Notice Title' parameter.
Other vulnerabilities in CodeAstro Human Resource Management System
See all- CVE-2026-13537Medium
A cross-site request forgery (CSRF) vulnerability was found in CodeAstro Human Resource Management System 1.0. An unknown function allows remote attackers to perform unauthorized actions on behalf of an authenticated user. The exploit has been made public and could be used.
- CVE-2026-13535Medium
A SQL injection vulnerability was found in CodeAstro Human Resource Management System 1.0 in the GetFileInfo function of Employee_model.php. Manipulating the ID argument in the view endpoint allows remote attack. The exploit has been published and may be used.
- CVE-2026-13525Medium
A SQL injection vulnerability was found in CodeAstro Human Resource Management System 1.0 in the emselectByCode function of Employee_model.php. The attack manipulates the emid argument in the Update_Earn_Leave endpoint. It can be exploited remotely and the exploit is publicly available.
Original NVD description (English source)
A vulnerability was identified in CodeAstro Human Resource Management System 1.0. Impacted is an unknown function of the file /notice/All_notice of the component Notice Board Management. Such manipulation of the argument Notice Title with the input <svg onload="alert('Stored XSS Triggered by Ashik Mohamed')"> as part of POST leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS