Cross-Site Scripting Vulnerability in Code-Projects Job Recruitment Software
CVE-2024-12980
Key Information:
- Vendor
Code-projects
- Status
- Vendor
- CVE Published:
- 27 December 2024
Badges
What is CVE-2024-12980?
A code flaw has been identified in the Job Recruitment 1.0 application produced by Code-Projects, specifically within the fln_update function located in the /_parse/_all_edits.php file. This vulnerability stems from improper handling of user input parameters, fname and lname, which can be exploited to perform cross-site scripting (XSS) attacks. Attackers can manipulate these arguments to inject malicious scripts, which could be executed in the context of other users’ browsers. Due to its nature, this vulnerability poses a significant risk, allowing remote exploitation and public visibility, thereby emphasizing the necessity for immediate patching and preventive measures.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
Job Recruitment 1.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V4
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved