CVE-2025-57117 describes a Clickjacking vulnerability in Rems' Employee Management System 1.0. The issue enables remote attackers to inject arbitrary JavaScript code via the Department Name field on the Add Department functionality, specifically affecting the department.php page. This vulnerability is classified under CWE-79, indicating a cross-site scripting flaw. The CVSS v3.1 base score is 5.4, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and low impact on confidentiality and integrity, with no impact on availability. There is no vendor advisory or patch information available at this time.

Successful exploitation allows remote attackers to execute arbitrary JavaScript in the context of the affected web application, potentially leading to limited confidentiality and integrity impacts. This could enable actions such as session hijacking or unauthorized actions within the application context. Availability is not affected. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with untrusted input on the Department Name field. No official fix or workaround has been published.