CVE-2026-105188: Cross Site Scripting in code-projects Human Resource Management System

This vulnerability in code-projects Human Resource Management System 1.0 allows remote attackers to perform cross-site scripting attacks via manipulation of the eventSubject argument in the Live Event History component's /views/admin/liveEventHistory.php file. The vulnerability enables injection of malicious scripts that could be executed in the context of the affected application. The vulnerability requires no privileges and no user interaction but has low impact on confidentiality and integrity, with no impact on availability. The exploit code has been made public.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other client-side attacks. However, the impact on confidentiality and integrity is low, and availability is not affected. The vulnerability requires no privileges and no user interaction, making it remotely exploitable.

No official patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting access to the affected component or applying input validation and sanitization on the eventSubject parameter to mitigate exploitation.