PT-2025-39660 · Sourcecodester · Employee Management System

Published 2025-09-26 · Updated 2025-09-26 · CVE-2025-26258

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sourcecodester Employee Management System version 1.0

Description The software is susceptible to Cross Site Scripting (XSS) attacks. The vulnerability is located in the 'Add Designation' functionality. The Add Designation feature does not properly sanitize user-supplied data, allowing an attacker to inject malicious scripts into the web page. These scripts can then be executed in the context of other users' browsers, potentially leading to session hijacking or defacement.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider implementing strict input validation and output encoding for the 'Add Designation' functionality.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-26258

Affected Products

Employee Management System

References · 7

• 🔥 https://github.com/oye-ujjwal/CVEs/blob/main/Employee%20Management%20System%20App/CVE-2025-26258 · Exploit
• https://osv.dev/vulnerability/CVE-2025-26258 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-26258 · Security Note
• https://twitter.com/VulmonFeeds/status/1971686224315191486 · Twitter Post
• https://twitter.com/CVEnew/status/1971619538270650537 · Twitter Post
• https://t.me/CVEtracker/33484 · Telegram Post
• https://sourcecodester.com/php/17847/employee-management-system-using-php-and-mysql-source-code.html · Note