Live › vulnerability › CVE-2026-116639
Go to dashboardAn unknown function in chat.php of the MD-MAFUJUL-HASAN Online-Payroll-Management-System fails to sanitize the ID argument, enabling cross-site scripting. An attacker can send a crafted link to a user of the application to run script in that user's browser session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 02:20 UTC. All times on this page are UTC.
Installations of the Online-Payroll-Management-System that include chat.php and are reachable by users, since the flaw is triggered through the ID argument over the network. Because the project ships a rolling release with no version numbers, the sources do not say which later commits are fixed. Teams that do not run this project can skip it.
No product ranges from the sources yet.
chat.php and whether it reads the ID parameter without escaping outputa8902bf64575e325f6d6bf93a55f7bd273ec58cd; the sources say versions up to this commit are affectedID parameter in chat.php or limit access to the applicationEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was detected in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to a8902bf64575e325f6d6bf93a55f7bd273ec58cd. Affected is an unknown function of the file chat.php. Performing a manipulation of the argument ID results in cross site scripting. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-116639")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.