Platform
php
Component
employee-management-xss
Fixed in
1.0.1
A cross-site scripting (XSS) vulnerability has been identified in the Employee Profile Management System, specifically affecting version 1.0. This flaw allows attackers to inject malicious scripts through manipulation of arguments within the /view_personnel.php file. Successful exploitation can lead to unauthorized access and data theft, impacting user accounts and sensitive information.
The XSS vulnerability in Employee Profile Management System allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session. This can be leveraged to steal session cookies, redirect users to malicious websites, or deface the application. An attacker could potentially gain access to sensitive employee data, including personal information, contact details, and potentially financial records, depending on the application's functionality. The impact is amplified if the application is used to manage highly sensitive employee data or if it integrates with other critical systems.
A public proof-of-concept (PoC) for this vulnerability is available, indicating a potential for widespread exploitation. The vulnerability was disclosed on 2025-12-07. While the CVSS score is LOW, the availability of a PoC increases the risk of exploitation, particularly if the system is publicly accessible. No KEV listing or confirmed exploitation campaigns are currently known.
Exploit Status
EPSS
0.04% (11% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-14194 is to upgrade to a patched version of the Employee Profile Management System. If upgrading immediately is not possible, consider implementing input validation and output encoding on the /view_personnel.php endpoint to sanitize user-supplied data. Web application firewalls (WAFs) can be configured to filter out malicious script injections. Regularly review and update security policies to prevent future XSS vulnerabilities.
Update to a patched version of the employee profile management system. Contact the vendor for a corrected version or apply the necessary security measures to prevent the injection of malicious code through the per_address, dr_school, and other_school parameters in the view_personnel.php file.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-14194 is a cross-site scripting (XSS) vulnerability affecting Employee Profile Management System version 1.0, allowing attackers to inject malicious scripts via manipulated arguments in /view_personnel.php.
If you are using Employee Profile Management System version 1.0, you are potentially affected by this vulnerability. Upgrade to a patched version as soon as possible.
The recommended fix is to upgrade to a patched version of the Employee Profile Management System. As a temporary workaround, implement input validation and output encoding on the vulnerable endpoint.
While no confirmed exploitation campaigns are currently known, a public proof-of-concept exists, increasing the risk of exploitation.
Refer to the official Employee Profile Management System website or security announcements for the latest advisory regarding CVE-2025-14194.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.