This vulnerability allows remote attackers to perform stored cross-site scripting attacks by injecting malicious SVG payloads into the Notice Title parameter of the /notice/All_notice endpoint in CodeAstro Human Resource Management System 1.0. The lack of proper input sanitization enables execution of arbitrary scripts when the stored notice is viewed. The CVSS 4.8 rating reflects medium severity with network attack vector, low complexity, and requirement for user interaction and high privileges.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected application, potentially allowing attackers to perform actions on behalf of authenticated users with high privileges. This could result in session hijacking, defacement, or other client-side impacts. However, the impact is limited by the need for user interaction and high privileges, and no direct system compromise is indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected functionality and carefully validate or sanitize inputs on the Notice Title parameter. Monitoring for suspicious activity related to this endpoint is advised. Avoid using the affected version in production environments if possible.