Cross Site Scripting Vulnerability in Saruf-Ratul HR-Payroll-Management-System
CVE-2026-116640

5.1MEDIUM

Key Information:

Vendor

Saruf-ratul

Status
Hr-payroll-management-system
Vendor
CVE Published:
27 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-116640?

A security flaw has been identified within the Saruf-Ratul HR-Payroll-Management-System, specifically in the 'chat.php' file. This vulnerability allows an attacker to execute a cross site scripting (XSS) attack by manipulating the argument ID, which could lead to unauthorized access or data manipulation. The exploit can be executed remotely, posing significant risks to users. Despite being reported, the Saruf-Ratul team has yet to respond to the issue. Continuous delivery practices complicate the identification of specific affected versions.

Affected Version(s)

HR-Payroll-Management-System 3fd6f45ead9f8197510c0910f759e06ee67251e5

HR-Payroll-Management-System e7cd81477001afdee95b843fd4137894d9418c9f

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-116640 - Proof of Concept

References

https://vuldb.com/vuln/426581
vdb-entrytechnical-description
https://vuldb.com/vuln/426581/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-116640
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

dexter-morgan (VulDB User)
VulDB CNA Team
.