The vulnerability arises in the chat.php component of Saruf‑Ratul:HR-Payroll-Management-System; by manipulating the ID argument an attacker can inject arbitrary HTML or JavaScript that is reflected back into the page, resulting in a cross‑site scripting flaw that can execute code in the victim’s browser and enable session hijacking or phishing. This weakness is a classic input‑validation failure (CWE-79) and, due to the exploitation of the ID parameter, also touches CWE-94. The flaw can be triggered remotely via a crafted HTTP request that passes a malicious value in the ID parameter, and the exploit code has already been published, indicating that attackers can target unpatched deployments.

The affected product is Saruf‑Ratul:HR-Payroll-Management-System. No specific release numbers are available because the project follows rolling releases and has not supplied updated version information, so deployments of any recent version that still contain the legacy chat.php behaviour are potentially vulnerable. The absence of a public patch means that the risk remains until the developers address the issue.

The CVSS score for this vulnerability is 5.1, reflecting a moderate severity that grants attackers the ability to run code in the user’s browser but does not grant system‑level access. The EPSS score is not available and the flaw is not listed in the CISA KEV catalog, suggesting relatively low but still present exploitation probability. Because a public exploit exists and the attacker can perform the attack remotely, organizations running the system should treat this as a medium‑risk issue and implement mitigations swiftly.