code-projects Job Recruitment load_user-profile.php cross site scripting

Successful exploitation of CVE-2025-1190 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session. This can lead to various malicious actions, including session hijacking, credential theft, and defacement of the Job Recruitment application. The attacker could potentially steal sensitive user data, such as login credentials or personal information, and use it for further malicious purposes. The impact is amplified if the application is used to manage sensitive job applicant data.

Organizations utilizing code-projects Job Recruitment version 1.0 and 1.0 are at risk. This includes businesses using the application for recruitment processes, particularly those with sensitive applicant data. Shared hosting environments where Job Recruitment is installed are also at increased risk due to potential cross-tenant vulnerabilities.

• php / web:

 grep -r "load_user-profile.php" /var/www/html/

• generic web:

curl -I http://your-job-recruitment-site.com/_parse/load_user-profile.php | grep -i "X-Powered-By"

1. 2025-02-12Disclosure

   disclosure

1. 予約済み2025-02-10
2. 公開日2025-02-12
3. EPSS 更新日2026-04-02

The primary mitigation for CVE-2025-1190 is to upgrade Job Recruitment to version 1.0.1 or later, which contains the necessary fix. If upgrading is not immediately feasible, consider implementing input validation and output encoding on the /parse/loaduser-profile.php file to sanitize user-supplied data. Web application firewalls (WAFs) configured to detect and block XSS attacks can also provide a temporary layer of protection. Regularly review and update security configurations to minimize the attack surface.