Description
A vulnerability was found in code-projects Human Resource Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /views/admin/liveEventHistory.php of the component Live Event History. The manipulation of the argument eventSubject results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used.
Published: 2026-10-05
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑Site Scripting (XSS)
Action: Apply Patch
AI Analysis

Impact

An attacker can send a crafted eventSubject parameter to the /views/admin/liveEventHistory.php page, which is reflected without proper sanitization, leading to client‑side script execution for any user who views the page; this allows theft of session cookies, page defacement, or arbitrary code execution in the victim’s context and is categorized as an uncontrolled script source (CWE‑79) and code injection (CWE‑94).

Affected Systems

The vulnerability is present in Code‑Projects Human Resource Management System 1.0 within the Live Event History component, affecting the admin view liveEventHistory.php and relying on an exposed eventSubject argument; no other products or versions are listed as affected and no vendor‑issued fix is currently available.

Risk and Exploitability

With a CVSS base score of 5.1 indicating moderate severity, the risk is elevated by the ability to launch the attack remotely and the public availability of proof‑of‑concept code; although the EPSS score is not provided and the vulnerability is not listed in the CISA KEV catalog, it remains exploitable to any user who has access to the Live Event History page, making it a significant concern for organizations running version 1.0.

Generated by OpenCVE AI on October 5, 2026 at 05:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the Human Resource Management System to the latest version once a patch is released.
  • Apply server‑side validation and output encoding to the eventSubject parameter to prevent reflected XSS.
  • Restrict access to the Live Event History administration page to authenticated privileged users and monitor traffic for suspicious script injection attempts.

Generated by OpenCVE AI on October 5, 2026 at 05:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 06 Oct 2026 21:15:00 +0000

Type Values Removed Values Added
First Time appeared Code-projects human Resource Management
Vendors & Products Code-projects human Resource Management

Mon, 05 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 05 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in code-projects Human Resource Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /views/admin/liveEventHistory.php of the component Live Event History. The manipulation of the argument eventSubject results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used.
Title code-projects Human Resource Management System Live Event History liveEventHistory.php cross site scripting
First Time appeared Code-projects
Code-projects human Resource Management System
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:code-projects:human_resource_management_system:*:*:*:*:*:*:*:*
Vendors & Products Code-projects
Code-projects human Resource Management System
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Human Resource Management Human Resource Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-05T15:30:22.324Z

Reserved: 2026-10-04T09:39:19.148Z

Link: CVE-2026-105188

cve-icon Vulnrichment

Updated: 2026-10-05T15:26:39.288Z

cve-icon NVD

Status : Deferred

Published: 2026-10-05T05:17:02.660

Modified: 2026-10-06T15:04:52.637

Link: CVE-2026-105188

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-06T21:00:06Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')