Live › vulnerability › CVE-2026-116640
Go to dashboardThe HR-Payroll-Management-System project has a flaw in chat.php where the ID argument is not sanitised, enabling cross-site scripting. An attacker who can get a user to open a crafted link can run script in that user's browser session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 02:20 UTC. All times on this page are UTC.
Teams running the Saruf-Ratul HR-Payroll-Management-System from the affected commits who expose chat.php to users. Deployments that do not serve chat.php or keep the application on an internal network without untrusted users are less exposed. The sources do not say which specific configurations are affected.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw has been found in Saruf-Ratul HR-Payroll-Management-System e7cd81477001afdee95b843fd4137894d9418c9f/3fd6f45ead9f8197510c0910f759e06ee67251e5. Affected by this vulnerability is an unknown functionality of the file chat.php. Executing a manipulation of the argument ID can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-116640")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.