A stored cross‑site scripting vulnerability exists in the Notice Board Management module of CodeAstro Human Resource Management System version 1.0. The flaw allows an attacker to submit a crafted Notice Title containing an HTML payload, such as a <svg> element with an onload event, to the /notice/All_notice endpoint via a POST request. When the resulting notice is viewed, the injected code is executed within the victim’s browser session, enabling the attacker to run arbitrary JavaScript. The CVE notes that the attack can be launched remotely and that publicly available exploits exist, but the description does not detail other downstream consequences such as session hijacking or data theft.

The affected system is CodeAstro Human Resource Management System version 1.0, as reported by the vendor. No other versions have been documented as vulnerable.

The CVSS score of 4.8 indicates moderate severity, while no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote and requires only the ability to send a crafted POST request to the /notice/All_notice endpoint; publicly available exploits suggest that an attacker could quickly test for the flaw.