CVE-2026-12130: CodeAstro Human Resource Management System Projects Management Add_Projects cross site scripting
A security flaw has been discovered in CodeAstro Human Resource Management System 1.0. This affects an unknown part of the file /Projects/AddProjects of the component Projects Management Page. The manipulation of the argument protitle results in cross site scripting. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
CodeAstro Human Resource Management System Projects Management Page (/Projects/Add_Projects)from your environment.If the Projects Management Add_Projects functionality is not required, disable or uninstall that component/feature to eliminate the vulnerable endpoint.
- Configuration
Implement server-side validation of the protitle parameter and apply proper output encoding/HTML-escaping in the /Projects/Add_Projects page to prevent cross-site scripting.
CodeAstro Human Resource Management System - Projects Management (/Projects/Add_Projects) protitle input handling = server-side input validation and output encoding/escaping for protitle - Compensating control
Restrict access to the /Projects/Add_Projects page using network controls (firewall, IP allowlist) or deploy a web application firewall (WAF) with rules to block XSS payloads until code is fixed.
- Operational
Audit logs and application data for signs of exploitation (malicious protitle values), remove or sanitize any stored malicious content, and monitor for attempts to exploit the vulnerability. Apply code fixes when available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12130?
The severity of CVE-2026-12130 is classified as low with a score of 3.5.
How do I fix CVE-2026-12130?
To fix CVE-2026-12130, ensure proper input validation and encoding for the 'protitle' argument to prevent cross site scripting.
What type of vulnerability is CVE-2026-12130?
CVE-2026-12130 is a cross site scripting (XSS) vulnerability that allows code injection.
In which software does CVE-2026-12130 occur?
CVE-2026-12130 occurs in the CodeAstro Human Resource Management System version 1.0.
What component is affected by CVE-2026-12130?
The affected component in CVE-2026-12130 is the Projects Management Page, specifically the /Projects/Add_Projects file.