CVE-2026-1161CWE-79CWE-94
pbrong hrms recruitment.go UpdateRecruitmentById cross site scripting
Medium · published January 19, 2026
What it is
A vulnerability was detected in pbrong hrms 1.0.1. The affected element is the function UpdateRecruitmentById of the file /handler/recruitment.go. The manipulation results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used.
The record
Technical detail
- CVSS v4.0
- 5.1 · MEDIUM
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
- EPSS
- 0.00233 · 13.4th percentile
- Weaknesses
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); CWE-94 · Improper Control of Generation of Code ('Code Injection')
- Published
- 2026-01-19T16:02Z
EPSS history
Timeline