CVE-2026-12130: CodeAstro HRMS XSS Vulnerability

CVE-2026-12130 Overview

CVE-2026-12130 is a stored cross-site scripting (XSS) vulnerability affecting CodeAstro Human Resource Management System 1.0. The flaw resides in the /Projects/Add_Projects endpoint, which is part of the Projects Management Page component. Attackers can inject malicious script payloads through the protitle parameter, and those payloads execute in the browser of any user who views the affected page. The attack is remotely exploitable and requires only low-privileged authenticated access combined with user interaction. A public proof-of-concept exploit has been released, increasing the likelihood of opportunistic abuse against unpatched deployments.

Critical Impact

Authenticated attackers can persist arbitrary JavaScript through the project title field, enabling session theft, UI redress, and credential harvesting against HR users.

Affected Products

• CodeAstro Human Resource Management System 1.0
• Projects Management Page component (/Projects/Add_Projects)
• Deployments exposing the protitle parameter without sanitization

Discovery Timeline

• 2026-06-12 - CVE-2026-12130 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-12130

Vulnerability Analysis

The vulnerability is classified as Cross-Site Scripting [CWE-79]. The /Projects/Add_Projects handler accepts the protitle parameter and stores its value without applying contextual output encoding or input validation. When the project list or detail view subsequently renders the stored title, the browser interprets the embedded markup as executable content. Because the payload persists in the application database, every authenticated user who loads the affected view triggers the injected script. The public proof-of-concept hosted in the Stored-XSS-via-Project-Title repository demonstrates a working payload against a default installation.

Root Cause

The root cause is missing server-side sanitization and missing output encoding on the protitle field. The application trusts user-supplied input and writes it directly into HTML contexts when rendering project records. No Content Security Policy (CSP) is enforced to restrict inline script execution, which amplifies the impact of the injection.

Attack Vector

An attacker authenticates with a low-privileged account that has permission to create projects. The attacker submits a crafted protitle value containing HTML or JavaScript through the Add Projects form. The payload is stored in the application backend. When an administrator or peer user loads the Projects Management Page, the payload executes in the victim's session context, allowing the attacker to read cookies, perform actions on behalf of the victim, or pivot to administrative functionality.

No verified exploit code is reproduced here. Refer to the GitHub PoC Repository and the VulDB CVE-2026-12130 entry for technical reproduction details.

Detection Methods for CVE-2026-12130

Indicators of Compromise

• Project records containing HTML tags such as <script>, <img onerror=>, or <svg onload=> within the protitle field.
• Web server access logs showing POST requests to /Projects/Add_Projects with encoded payload characters in the body.
• Unexpected outbound requests from HR user browsers to attacker-controlled domains shortly after loading the Projects page.

Detection Strategies

• Inspect the projects database table for stored entries whose title fields contain angle brackets, event handlers, or JavaScript URI schemes.
• Deploy a Web Application Firewall (WAF) rule set that flags reflected and stored XSS signatures targeting the protitle parameter.
• Correlate authenticated session activity with anomalous DOM events or script loads originating from the Projects Management Page.

Monitoring Recommendations

• Enable verbose application logging on the /Projects/Add_Projects endpoint and forward logs to a centralized analytics platform for review.
• Monitor for new project creations followed by rapid administrator views of the same record, which can indicate targeting of privileged users.
• Track browser console errors and CSP violation reports if a CSP is deployed during remediation testing.

How to Mitigate CVE-2026-12130

Immediate Actions Required

• Restrict access to the Add Projects functionality to trusted users until a patch is applied.
• Audit existing project records and remove any entries containing HTML or script content in the title field.
• Rotate session cookies and credentials for any account that may have viewed malicious project entries.

Patch Information

No vendor patch has been published in the NVD record at the time of writing. Monitor the CodeAstro vendor site and the VulDB Vulnerability Report for updates. Apply input validation and output encoding fixes in custom builds until an official release is available.

Workarounds

• Implement server-side input validation that rejects angle brackets and JavaScript event handler patterns in the protitle parameter.
• Apply HTML entity encoding to all project title fields at rendering time across every view that displays project data.
• Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
• Place the application behind a WAF with managed XSS rule sets enabled in blocking mode.

# Example nginx CSP header to mitigate inline script execution
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;