CVE-2026-38569

🗓️ 11 May 2026 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 28 Views🌐 WEB

CVE-2026-38569: HireFlow v1.2 has XSS on candidate_detail.html via Resume or Feedback Comment fields.

Reporter	Title	Published	Views	Family All 9
GithubExploit	CVE-Disclosures	8 May 202615:36	–	githubexploit
ATTACKERKB	CVE-2026-38569	11 May 202600:00	–	attackerkb
CNNVD	HireFlow 跨站脚本漏洞	11 May 202600:00	–	cnnvd
Cvelist	CVE-2026-38569	11 May 202600:00	–	cvelist
EUVD	EUVD-2026-29117	11 May 202618:31	–	euvd
NVD	CVE-2026-38569	11 May 202618:16	–	nvd
Positive Technologies	PT-2026-39657	11 May 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-38569	5 Jun 202619:49	–	redhatcve
Vulnrichment	CVE-2026-38569	11 May 202600:00	–	vulnrichment

Source	Link
github	www.github.com/hijackedamygdala/CVE-Disclosures/tree/main/HireFlow/CVE-2026-38569
sourcecodester	www.sourcecodester.com/python/18688/hireflow-%E2%80%93-complete-interview-management-system.html
github	www.github.com/StratonWebDesigners/HireFlow

Parameter	Position	Path	Description	CWE
Resume	request body	/candidates/add	Stored Cross-Site Scripting (XSS) in candidate_detail.html via Resume field	CWE-79
Feedback Comment	request body	/feedback/add	Stored Cross-Site Scripting (XSS) via Feedback Comment field in candidate_detail.html	CWE-79

17 Jun 2026 10:41Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.15.4

EPSS0.00208

SSVC