CVE-2025-40685

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources
Severity
4.8MEDIUM
EPSS
0.0%
top 92.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Human Resource Management System Human Resource Management SystemOretnom23 Human Resource Management System
Timeline
PublishedJul 29

Description

Reflected Cross-Site Scripting (XSS) in Human Resource Management System version 1.0. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the 'searcstate' parameter in/state.php.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-75qp-q2mh-2hw5: Reflected Cross-Site Scripting (XSS) in Human Resource Management System version 1↗2025-07-29
▶
CVEList
Reflected Cross-Site Scripting (XSS) vulnerability in Human Resource Management System↗2025-07-29
▶
CVE-2025-40685 (MEDIUM CVSS 4.8) | Reflected Cross-Site Scripting (XSS | cvebase.io