CVE-2026-116640

LowCVSS 3.5/10Last modified Oct 27, 2026

Description

A flaw has been found in Saruf-Ratul HR-Payroll-Management-System e7cd81477001afdee95b843fd4137894d9418c9f/3fd6f45ead9f8197510c0910f759e06ee67251e5. Affected by this vulnerability is an unknown functionality of the file chat.php. Executing a manipulation of the argument ID can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79CWE-94

Affected software

VendorProductVersions
Saruf-RatulHR-Payroll-Management-System3fd6f45ead9f8197510c0910f759e06ee67251e5; e7cd81477001afdee95b843fd4137894d9418c9f

References

Timeline

Published
Oct 27, 2026
Last modified
Oct 27, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1166416.8The DB Tools rely on the TLS implementation in Golang’s standard library, which generally uses the system CA store. However, the crypto/x509CVE-2026-1166457.1LimeSurvey Community Edition 7.8.0 contains an SQL injection vulnerability in the survey-archive participant import and SPSS-response exportCVE-2026-1166464.3Tanium addressed an uncontrolled resource consumption vulnerability in Threat Response.CVE-2026-1166477.1Tanium addressed an improper output sanitization vulnerability in Comply.CVE-2026-1166484.1Tanium addressed an improper output sanitization vulnerability in Discover.CVE-2026-1166497.1Tanium addressed an improper output sanitization vulnerability in Enforce.CVE-2026-116654.3Out of bounds read in Dawn in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker to leak cross-origin data via a craCVE-2026-1166508.8Tanium addressed an unauthorized code execution vulnerability in Threat Response.CVE-2026-1166518.8Tanium addressed an unauthorized code execution vulnerability in Threat Response.CVE-2026-1166524.3Tanium addressed a business logic error in Threat Response.CVE-2026-1166534.3Tanium addressed an improper input validation vulnerability in Threat Response.CVE-2026-1166546.5Tanium addressed an improper input validation vulnerability in Threat Response.
CVE-2026-116640: Low severity, CVSS 3.5 | Vulnix