CVE-2025-40683: ORETNOM23 Human Resource Management System

Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days.

Reflected Cross-Site Scripting (XSS) in Human Resource Management System version 1.0. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the 'searccity' parameter in /city.php.

Affected products

• ORETNOM23 Human Resource Management System: version 1.0 only

Published 2025-07-29. Last modified 2026-06-17.