A cross-site scripting (XSS) vulnerability exists in the chat.php file of the MD-MAFUJUL-HASAN Online-Payroll-Management-System up to commit a8902bf64575e325f6d6bf93a55f7bd273ec58cd. The vulnerability arises from manipulation of the ID argument and can be exploited remotely. The project has not yet responded to the issue report, and no fixed versions or patches are currently available. The vulnerability has a low severity score of 3.5 (CVSS 3.1).