---
id: "CVE-2026-116639"
kind: "vulnerability"
aliases: ["CVE-2026-116639"]
title: "Online Payroll Management System: chat.php ID parameter allows cross-site scripting"
severity: "medium"
cvss: 4.0
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "payroll", "php", "self-hosted"]
not_affected_if: ["not-deployed"]
published_at: "2026-10-27T02:16:45+00:00"
first_seen_at: "2026-10-27T02:20:18+00:00"
updated_at: "2026-10-27T02:21:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116639", "first_seen_at": "2026-10-27T02:20:18+00:00"}]
---

# Online Payroll Management System: chat.php ID parameter allows cross-site scripting

An unknown function in chat.php of the MD-MAFUJUL-HASAN Online-Payroll-Management-System fails to sanitize the ID argument, enabling cross-site scripting. An attacker can send a crafted link to a user of the application to run script in that user's browser session.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the deployment includes a file named `chat.php` and whether it reads the `ID` parameter without escaping output
- Compare the deployed commit against `a8902bf64575e325f6d6bf93a55f7bd273ec58cd`; the sources say versions up to this commit are affected

## Fix

- unknown: the project has not responded and no fixed release or patch is listed in the sources
- Until a fix exists, escape or restrict the `ID` parameter in `chat.php` or limit access to the application

## Timeline

- 2026-10-27T02:20:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116639

## From the sources

A vulnerability was detected in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to a8902bf64575e325f6d6bf93a55f7bd273ec58cd. Affected is an unknown function of the file chat.php. Performing a manipulation of the argument ID results in cross site scripting. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_