Vulnerability · Published Jun 8, 2026 · Assigned by VulDB
CVE-2026-11491CodeAstro Human Resource Management System Notice Board Management All_notice cross site scripting
Low 2.4
In plain English
A low-severity cross-site scripting in Human Resource Management System from CodeAstro. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).
Official description
A vulnerability was identified in CodeAstro Human Resource Management System 1.0. Impacted is an unknown function of the file /notice/All_notice of the component Notice Board Management. Such manipulation of the argument Notice Title with the input <svg onload="alert('Stored XSS Triggered by Ashik Mohamed')"> as part of POST leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| CodeAstro | Human Resource Management System | 1.0 |
Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
References
- VDB-369111 | CodeAstro Human Resource Management System Notice Board Management All_notice cross site scripting vdb-entry, technical-description
- VDB-369111 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-11491 | CVE Analysis and Report third-party-advisory
- Submit #834747 | CodeAstro Human Resource Management System in PHP CodeIgniter 1.0 Cross Site Scripting third-party-advisory
- https://github.com/ashikmd0507/CVE/blob/main/CVE-2026-11491/README.md exploit
- https://codeastro.com/ product