The vulnerability in chat.php allows a remote attacker to manipulate the ID parameter, resulting in cross‑site scripting. By injecting malicious script code, an attacker can execute arbitrary JavaScript in the browsers of users who view the contaminated data, enabling session hijacking, credential theft, defacement, or additional malicious activity. The flaw corresponds to CWE‑79 and has a CVSS score of 5.1, indicating moderate severity.

MD‑MAFUJUL‑HASAN Online‑Payroll‑Management‑System. All current releases that include the chat.php module are affected, as the project uses a rolling release model and no versioned update is yet available.

The exploit can be initiated remotely without authentication, and it is publicly available. Although the EPSS score is not reported and the vulnerability is not listed in the CISA KEV catalog, the public availability of an exploit means the risk remains noticeable. The lack of an official patch amplifies the window of exposure until the vendor releases a fix.