The vulnerability resides in CodeAstro Human Resource Management System version 1.0, specifically in the /dashboard/add_tod component. Tampering with the todo_data argument leads to stored cross‑site scripting. When an attacker injects malicious JavaScript, the code executes in a victim’s browser, potentially stealing credentials, session cookies, or performing actions on behalf of the user. The flaw falls under CWE‑79.

Affected systems are installations of CodeAstro Human Resource Management System 1.0 that expose the /dashboard/add_tod endpoint. No other versions or components have been identified as vulnerable based on the provided data.

The CVSS score of 5.1 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Because the attack vector can be initiated remotely by manipulating the todo_data parameter, and the exploit is publicly available, the risk to any exposed installation is notable. Attacks would involve an attacker sending a crafted request, which the system stores and later renders without proper output encoding, thereby enabling the injected script to run in a victim’s browser.