CVE-2025-2590

4.8 mediumEPSS 0.3%

Medium (4.8) in code-projects human resource management. EPSS 0.3% chance of exploitation in the next 30 days.

A vulnerability was found in code-projects Human Resource Management System 1.0.1. It has been classified as problematic. Affected is the function UpdateRecruitmentById of the file \handler\recruitment.go. The manipulation of the argument c leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Severity

CVSS 4.0

4.8 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 27% of CVEs (scores of 2026-10-31)
CWEs: CWE-79, CWE-94
Published: 2025-03-21
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

code-projects:human_resource_management

References

https://code-projects.org/
https://github.com/38279/1/issues/2
https://vuldb.com/?ctiid.300570
https://vuldb.com/?id.300570
https://vuldb.com/?submit.517344

Check your stack JSON