PT-2022-25383 · Unknown · Employee Performance Evaluation System

Published 2022-12-19 · Updated 2022-12-27 · CVE-2022-40435

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Employee Performance Evaluation System version 1.0

Description The issue is related to a persistent cross-site scripting (XSS) vulnerability. This vulnerability can be exploited via adding new entries under the Departments and Designations module.

Recommendations For Employee Performance Evaluation System version 1.0, consider restricting access to the Departments and Designations module until a patch is available. As a temporary workaround, avoid adding new entries under this module to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-40435

Affected Products

Employee Performance Evaluation System

References · 5

• 🔥 https://isaghojaria.medium.com/employee-performance-evaluation-system-v1-0-fdf7eb5eaf92 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-40435 · Security Note
• https://osv.dev/vulnerability/CVE-2022-40435 · Vendor Advisory
• https://sourcecodester.com · Note
• http://employee.com · Note