CVE-2026-12130 is a cross-site scripting vulnerability affecting CodeAstro Human Resource Management System version 1.0. The flaw exists in the Projects Management Page component, where the 'protitle' parameter in the /Projects/Add_Projects endpoint is not properly sanitized, enabling remote attackers to inject and execute arbitrary scripts in the context of the affected application. The vulnerability is remotely exploitable without requiring user interaction or elevated privileges. No vendor-provided fix or mitigation is currently available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the victim's browser session within the context of the vulnerable application. This may lead to session hijacking, defacement, or other malicious actions depending on the victim's privileges and the application's functionality. The CVSS 4.0 base score is 5.1, indicating a medium severity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing input validation and output encoding on the 'protitle' parameter as a temporary mitigation. Additionally, applying web application firewalls (WAF) rules to detect and block XSS payloads targeting this parameter may reduce risk.