---
id: "CVE-2026-116640"
kind: "vulnerability"
aliases: ["CVE-2026-116640"]
title: "HR-Payroll-Management-System: chat.php ID parameter allows cross-site scripting"
severity: "medium"
cvss: 4.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["hr-software", "package", "php", "self-hosted"]
not_affected_if: ["chat-module-unused"]
published_at: "2026-10-27T02:16:45+00:00"
first_seen_at: "2026-10-27T02:20:18+00:00"
updated_at: "2026-10-27T02:21:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116640", "first_seen_at": "2026-10-27T02:20:18+00:00"}]
---

# HR-Payroll-Management-System: chat.php ID parameter allows cross-site scripting

The HR-Payroll-Management-System project has a flaw in chat.php where the ID argument is not sanitised, enabling cross-site scripting. An attacker who can get a user to open a crafted link can run script in that user's browser session.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the deployment includes chat.php by looking for the file in the web root.
- Confirm the commit in use: unknown if the sources do not say which commit to compare against.

## Fix

- unknown: the project is a rolling release with no fixed version, and the maintainer has not responded to the report.
- Until a fix exists, restrict access to chat.php or remove it if it is not needed.

## Timeline

- 2026-10-27T02:20:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116640

## From the sources

A flaw has been found in Saruf-Ratul HR-Payroll-Management-System e7cd81477001afdee95b843fd4137894d9418c9f/3fd6f45ead9f8197510c0910f759e06ee67251e5. Affected by this vulnerability is an unknown functionality of the file chat.php. Executing a manipulation of the argument ID can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_