CVE-2026-11491
LOWCVSS v3.1: 2.4 · EPSS: 0.0003 (10.1 percentile)
Source data as of:
At a glance
- Severity
- LOW
- CVSS
- 2.4 v3.1 · NVD
- EPSS
- 0.0003 (10.1 percentile) · FIRST.org
- CISA KEV
- No
- Type
- XSS, Code Injection · NVD CWE
- Attack conditions (CVSS vector)
- Network · Source: NVD Vector
- Published
- 2026-06-08 · Modified: 2026-06-08
- References
- Jump to references (6)
CVSS / EPSS / KEV
Source — CVSS: NVD · EPSS: FIRST.org · KEV: CISA. Data & Sources
Description
A vulnerability was identified in CodeAstro Human Resource Management System 1.0. Impacted is an unknown function of the file /notice/All_notice of the component Notice Board Management. Such manipulation of the argument Notice Title with the input <svg onload="alert('Stored XSS Triggered by Ashik Mohamed')"> as part of POST leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
References
Reference URLs as listed by NVD, grouped by a mechanical match on the link's host/pattern. Labels describe the link type only.
- Reference https://codeastro.com/
- Reference https://github.com/ashikmd0507/CVE/blob/main/CVE-2026-11491/README.md
- Reference https://vuldb.com/cve/CVE-2026-11491
- Reference https://vuldb.com/submit/834747
- Reference https://vuldb.com/vuln/369111
- Reference https://vuldb.com/vuln/369111/cti