CVE-2023-6282 Information

Description

IceHrm 23.0.0.OS does not sufficiently encode user-controlled input which creates a Cross-Site Scripting (XSS) vulnerability via /icehrm/app/fileupload_page.php in multiple parameters. An attacker could exploit this vulnerability by sending a specially crafted JavaScript payload and partially hijacking the victim’s browser.

Reference

https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-icehrm