HireFlow Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in HireFlow version 1.2. The issue arises in the 'candidate_detail.html' file, specifically within the Resume and Feedback Comment fields. This vulnerability can be exploited via POST requests to '/candidates/add' or '/feedback/add'.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a POST request to '/candidates/add' or '/feedback/add' with a payload that includes a script or other HTML elements in the Resume or Feedback Comment fields. The injected script will be executed when the 'candidate_detail.html' page is loaded.

Remediation

Users are advised to update to HireFlow version 1.3, where this vulnerability has been patched.