CVE-2026-38569

View on CVE.org
Published May 11, 2026 CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Description
HireFlow v1.2 is vulnerable to Cross Site Scripting (XSS) in candidate_detail.html via the Resume or Feedback Comment fields via POST /candidates/add or POST /feedback/add.

Analysis

AI-generated

Technical impact

The vulnerability in HireFlow v1.2 allows injection of arbitrary HTML and JavaScript into the Resume or Feedback Comment fields. When a user submits data via the POST /candidates/add or POST /feedback/add endpoints, the content is stored without sanitization and later displayed in candidate_detail.html, resulting in client‑side script execution. This is a classic stored XSS flaw classified as CWE‑79.

Affected Systems

The affected software is HireFlow version 1.2. No additional vendor or product information is specified beyond the application name and version. The scope is limited to the application; there is no mention of external dependencies or system components.

Risk and Exploitability

The CVSS score of 5.4 denotes moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation. Exploitation requires the ability to send the relevant POST requests, which likely depends on access to the application but is not detailed in the description. The risk is considered moderate pending further information on the attack vector.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to a patched version of HireFlow if one is released by the maintainers.
  • If no patch exists, implement server‑side input validation by stripping or escaping HTML tags for Resume and Feedback Comment before storage and rendering.
  • Employ a Content Security Policy that blocks inline scripts and restricts allowed script sources, thereby limiting the impact of any residual unsanitized input.

Generated by OpenCVE AI on May 11, 2026 at 21:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Stratonwebdesigners
Stratonwebdesigners hireflow
Vendors & Products Stratonwebdesigners
Stratonwebdesigners hireflow
Type Values Removed Values Added
Title Cross‑Site Scripting via Resume or Feedback Comment Fields in HireFlow v1.2
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title Cross‑Site Scripting via Resume or Feedback Comment Fields in HireFlow v1.2
Weaknesses CWE-79
Type Values Removed Values Added
Description HireFlow v1.2 is vulnerable to Cross Site Scripting (XSS) in candidate_detail.html via the Resume or Feedback Comment fields via POST /candidates/add or POST /feedback/add.
References
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
May 11, 2026, 6:20 PM
Reserved
Apr 6, 2026, 12:00 AM

View source JSON

Updated
May 11, 2026, 6:20 PM

JSON

Status
Deferred
Published
May 11, 2026, 6:16 PM
Modified
Jun 17, 2026, 10:41 AM

View source JSON

No data.

Updated
May 12, 2026, 9:23 AM

JSON