{"id":"CVE-2026-116640","kind":"vulnerability","aliases":["CVE-2026-116640"],"related":[],"title":"HR-Payroll-Management-System: chat.php ID parameter allows cross-site scripting","description":"A flaw has been found in Saruf-Ratul HR-Payroll-Management-System e7cd81477001afdee95b843fd4137894d9418c9f/3fd6f45ead9f8197510c0910f759e06ee67251e5. Affected by this vulnerability is an unknown functionality of the file chat.php. Executing a manipulation of the argument ID can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.","summary":"The HR-Payroll-Management-System project has a flaw in chat.php where the ID argument is not sanitised, enabling cross-site scripting. An attacker who can get a user to open a crafted link can run script in that user's browser session.","severity":"medium","cvss":4.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hr-software","package","php","self-hosted"],"not_affected_if":["chat-module-unused"],"how_to_check":"- Check whether the deployment includes chat.php by looking for the file in the web root.\n- Confirm the commit in use: unknown if the sources do not say which commit to compare against.","fix":"- unknown: the project is a rolling release with no fixed version, and the maintainer has not responded to the report.\n- Until a fix exists, restrict access to chat.php or remove it if it is not needed.","status":"open","published_at":"2026-10-27T02:16:45+00:00","first_seen_at":"2026-10-27T02:20:18+00:00","triaged_at":"2026-10-27T02:21:28+00:00","updated_at":"2026-10-27T02:21:28+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-27T02:21:28Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the project is a rolling release with no fixed version, and the maintainer has not responded to the report.\n- Until a fix exists, restrict access to chat.php or remove it if it is not needed.","reach":"internet","title":"HR-Payroll-Management-System: chat.php ID parameter allows cross-site scripting","impact":"medium","summary":"The HR-Payroll-Management-System project has a flaw in chat.php where the ID argument is not sanitised, enabling cross-site scripting. An attacker who can get a user to open a crafted link can run script in that user's browser session.","category":"package","nicknames":[],"who_cares":["php","self-hosted","hr-software"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Script runs in a victim's browser within the application session.","analyst_note":"Find out whether the project has released a fix or a version scheme; check the NVD entry and the linked exploit disclosure for the exact vulnerable parameter and any mitigation.","how_to_check":"- Check whether the deployment includes chat.php by looking for the file in the web root.\n- Confirm the commit in use: unknown if the sources do not say which commit to compare against.","needs_analyst":true,"not_affected_if":["chat-module-unused"],"who_is_affected":"Teams running the Saruf-Ratul HR-Payroll-Management-System from the affected commits who expose chat.php to users. Deployments that do not serve chat.php or keep the application on an internal network without untrusted users are less exposed. The sources do not say which specific configurations are affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000631,"input_tokens":3432,"output_tokens":575,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116640':16A,19A '-2026':15A,18A 'affect':88C,146C 'allow':9A 'approach':134C 'argument':43B,105C 'attack':53B,119C 'avail':152C 'browser':71B 'chat.php':6A,39B,99C 'contini':140C 'craft':62B 'cross':11A,49B,110C 'cross-sit':10A,48B 'cve':14A,17A 'deliveri':141C 'detail':144C 'e7cd81477001afdee95b843fd4137894d9418c9f/3fd6f45ead9f8197510c0910f759e06ee67251e5':87C 'earli':160C 'enabl':47B 'execut':100C 'exploit':122C 'file':98C 'flaw':37B,74C 'found':77C 'function':95C 'get':56B 'host':27B 'hr':2A,21B,30B,83C 'hr-payroll-management-system':1A,29B,82C 'hr-softwar':20B 'id':7A,42B,106C 'inform':156C 'issu':163C 'launch':117C 'lead':108C 'link':63B 'manag':4A,32B,85C 'manipul':102C 'may':127C 'open':60B 'packag':23B 'paramet':8A 'payrol':3A,31B,84C 'php':24B 'possibl':115C 'problem':159C 'product':131C 'project':34B,154C 'provid':139C 'publish':125C 'ratul':81C 'releas':137C,149C 'remot':120C 'report':164C 'respond':168C 'roll':136C 'run':65B 'sanitis':46B 'saruf':80C 'saruf-ratul':79C 'script':13A,51B,66B,112C 'self':26B 'self-host':25B 'session':72B 'site':12A,50B,111C 'softwar':22B 'system':5A,33B,86C 'take':132C 'therefor':142C 'unknown':94C 'updat':148C 'use':129C 'user':58B,69B 'version':143C 'vulner':91C 'yet':169C","nicknames":[],"mitigations":[],"who_affected":"Teams running the Saruf-Ratul HR-Payroll-Management-System from the affected commits who expose chat.php to users. Deployments that do not serve chat.php or keep the application on an internal network without untrusted users are less exposed. The sources do not say which specific configurations are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T02:16:45+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116640","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116640","severity":null,"published_at":"2026-10-27T02:16:45+00:00","modified_at":"2026-10-27T02:16:45+00:00","first_seen_at":"2026-10-27T02:20:18+00:00","fetched_at":"2026-10-27T02:20:18+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}