CVE-2025-40685: Reflected Cross-Site Scripting (XSS) in Human Resource Management System version 1.0

Medium severity · published Jul 29, 2025

CVE-2025-40685

Reflected Cross-Site Scripting (XSS) in Human Resource Management System version 1.0

6.1

CVSS

0.2%

EPSS

On KEV

Description

Reflected Cross-Site Scripting (XSS) in Human Resource Management System version 1.0. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the 'searcstate' parameter in/state.php.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

Low

Integrity

Low

Availability

None

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)0.2% · higher than 8% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Human Resource Management System · Oretnom23

1.0 · source: NVD

Affected product

Human Resource Management System

Oretnom23

All Human Resource Management System CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2025-40685

CVE.org

https://www.cve.org/CVERecord?id=CVE-2025-40685

Third Party Advisory

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-human-resource-management-system

More from Human Resource Management System

9.8

CVE-2025-40682

SQL injection vulnerability in Human Resource Management System version 1.0, which allows an attacker to retrieve, create, update and delete databases via the “city” and “state”…

9.8

CVE-2024-35469

A SQL injection vulnerability in /hrm/user/ in SourceCodester Human Resource Management System 1.0 allows attackers to execute arbitrary SQL commands via the password parameter

9.8

CVE-2023-3391

A vulnerability was found in SourceCodester Human Resource Management System 1.0

9.8

CVE-2022-4273

A vulnerability, which was classified as critical, has been found in SourceCodester Human Resource Management System 1.0

9.8

CVE-2022-43262

Human Resource Management System v1.0 was discovered to contain a SQL injection vulnerability via the password parameter at /hrm/controller/login.php