{"id":"CVE-2026-116639","kind":"vulnerability","aliases":["CVE-2026-116639"],"related":[],"title":"Online Payroll Management System: chat.php ID parameter allows cross-site scripting","description":"A vulnerability was detected in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to a8902bf64575e325f6d6bf93a55f7bd273ec58cd. Affected is an unknown function of the file chat.php. Performing a manipulation of the argument ID results in cross site scripting. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.","summary":"An unknown function in chat.php of the MD-MAFUJUL-HASAN Online-Payroll-Management-System fails to sanitize the ID argument, enabling cross-site scripting. An attacker can send a crafted link to a user of the application to run script in that user's browser session.","severity":"medium","cvss":4.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","payroll","php","self-hosted"],"not_affected_if":["not-deployed"],"how_to_check":"- Check whether the deployment includes a file named `chat.php` and whether it reads the `ID` parameter without escaping output\n- Compare the deployed commit against `a8902bf64575e325f6d6bf93a55f7bd273ec58cd`; the sources say versions up to this commit are affected","fix":"- unknown: the project has not responded and no fixed release or patch is listed in the sources\n- Until a fix exists, escape or restrict the `ID` parameter in `chat.php` or limit access to the application","status":"open","published_at":"2026-10-27T02:16:45+00:00","first_seen_at":"2026-10-27T02:20:18+00:00","triaged_at":"2026-10-27T02:21:28+00:00","updated_at":"2026-10-27T02:21:28+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-27T02:21:28Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the project has not responded and no fixed release or patch is listed in the sources\n- Until a fix exists, escape or restrict the `ID` parameter in `chat.php` or limit access to the application","reach":"internet","title":"Online Payroll Management System: chat.php ID parameter allows cross-site scripting","impact":"medium","summary":"An unknown function in chat.php of the MD-MAFUJUL-HASAN Online-Payroll-Management-System fails to sanitize the ID argument, enabling cross-site scripting. An attacker can send a crafted link to a user of the application to run script in that user's browser session.","category":"other","nicknames":[],"who_cares":["php","self-hosted","payroll"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Script runs in a logged-in user's browser session, reading or acting as that user","analyst_note":"Confirm whether a fixed commit exists and whether chat.php is reachable without authentication; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-116639.","how_to_check":"- Check whether the deployment includes a file named `chat.php` and whether it reads the `ID` parameter without escaping output\n- Compare the deployed commit against `a8902bf64575e325f6d6bf93a55f7bd273ec58cd`; the sources say versions up to this commit are affected","needs_analyst":true,"not_affected_if":["not-deployed"],"who_is_affected":"Installations of the Online-Payroll-Management-System that include chat.php and are reachable by users, since the flaw is triggered through the ID argument over the network. Because the project ships a rolling release with no version numbers, the sources do not say which later commits are fixed. Teams that do not run this project can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000666,"input_tokens":3416,"output_tokens":649,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116639':15A,18A '-2026':14A,17A 'a8902bf64575e325f6d6bf93a55f7bd273ec58cd':90C 'affect':91C,145C 'allow':8A 'applic':64B 'argument':46B,105C 'attack':53B,118C 'avail':150C 'browser':72B 'chat.php':5A,29B,99C 'contini':138C 'craft':57B 'cross':10A,49B,109C 'cross-sit':9A,48B 'cve':13A,16A 'deliveri':139C 'detail':143C 'detect':77C 'earli':158C 'enabl':47B 'exploit':121C 'fail':41B 'file':98C 'function':27B,95C 'hasan':35B,82C 'host':24B 'id':6A,45B,106C 'inform':154C 'initi':116C 'issu':161C 'link':58B 'mafujul':34B,81C 'manag':3A,39B,86C 'manipul':102C 'may':126C 'md':33B,80C 'md-mafujul-hasan':32B,79C 'onlin':1A,37B,84C 'online-payroll-management-system':36B,83C 'paramet':7A 'payrol':2A,20B,38B,85C 'perform':100C 'php':21B 'possibl':114C 'problem':157C 'product':130C 'project':152C 'provid':137C 'public':124C 'releas':135C,148C 'remot':119C 'report':162C 'respond':166C 'result':107C 'roll':134C 'run':66B 'sanit':43B 'script':12A,51B,67B,111C 'self':23B 'self-host':22B 'send':55B 'session':73B 'site':11A,50B,110C 'system':4A,40B,87C 'therefor':140C 'unknown':26B,94C 'updat':147C 'use':128C,132C 'user':61B,70B 'version':142C 'vulner':75C 'yet':167C","nicknames":[],"mitigations":[],"who_affected":"Installations of the Online-Payroll-Management-System that include chat.php and are reachable by users, since the flaw is triggered through the ID argument over the network. Because the project ships a rolling release with no version numbers, the sources do not say which later commits are fixed. Teams that do not run this project can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T02:16:45+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116639","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116639","severity":null,"published_at":"2026-10-27T02:16:45+00:00","modified_at":"2026-10-27T02:16:45+00:00","first_seen_at":"2026-10-27T02:20:18+00:00","fetched_at":"2026-10-27T02:20:18+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}