CVE-2026-11491
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A stored XSS vulnerability was found in CodeAstro Human Resource Management System 1.0 in the Notice Board Management function. Manipulating the 'Notice Title' argument via POST with JavaScript code leads to script execution in the victim's browser.
Risk Assessment
An attacker can remotely execute malicious scripts in another user's session, potentially leading to session hijacking, account takeover, or further attacks.
Recommendation
Immediately update the system to a patched version or apply input filtering and output encoding for the 'Notice Title' parameter.
Original NVD description (English source)
A vulnerability was identified in CodeAstro Human Resource Management System 1.0. Impacted is an unknown function of the file /notice/All_notice of the component Notice Board Management. Such manipulation of the argument Notice Title with the input <svg onload="alert('Stored XSS Triggered by Ashik Mohamed')"> as part of POST leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used.