Ashik Mohamed

3 exploits Active since Jun 2026
CVE-2026-12130 WRITEUP LOW WRITEUP
CodeAstro Human Resource Management System Projects Management Add_Projects cross site scripting
A security flaw has been discovered in CodeAstro Human Resource Management System 1.0. This affects an unknown part of the file /Projects/Add_Projects of the component Projects Management Page. The manipulation of the argument protitle results in cross site scripting. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
CVSS 3.5
CVE-2026-12131 WRITEUP MEDIUM WRITEUP
CodeAstro Human Resource Management System Payroll Invoice Payroll.php sql injection
A weakness has been identified in CodeAstro Human Resource Management System 1.0. This vulnerability affects the function Invoice of the file \application\controllers\Payroll.php of the component Payroll Invoice Module. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
CVSS 6.3
CVE-2026-11491 WRITEUP LOW WRITEUP
CodeAstro Human Resource Management System Notice Board Management All_notice cross site scripting
A vulnerability was identified in CodeAstro Human Resource Management System 1.0. Impacted is an unknown function of the file /notice/All_notice of the component Notice Board Management. Such manipulation of the argument Notice Title with the input <svg onload="alert('Stored XSS Triggered by Ashik Mohamed')"> as part of POST leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
CVSS 2.4