CVE-2024-12980

code-projects Job Recruitment _all_edits.php fln_update cross site scripting

Published: Dec 27, 2024Updated: Feb 18, 2025 Sources: CVE List NVDCWE-79

4.3MEDIUM

Description

A vulnerability was found in code-projects Job Recruitment 1.0. It has been classified as problematic. Affected is the function fln_update of the file /_parse/_all_edits.php. The manipulation of the argument fname/lname leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

In plain language

AI Worth attention

Job Recruitment 1.0 has a flaw that can let a malicious link alter what a user sees; small businesses using it should address it soon because a public attack example exists.

Executive summary

Unauthenticated reflected XSS in Job Recruitment 1.0 through the fname/lname parameters handled by fln_update in /_parse/_all_edits.php.

If affected, business impact

Staff account actionsRecruitment data exposureFraudulent-looking pagesHiring workflow disruption

What to do now

Check whether you run Job Recruitment 1.0 and whether users can access its recruitment pages.
Ask your software vendor whether a supported update or corrected release is available; no fixed version has been published.
Until a fix is available, limit access to the affected recruitment pages to trusted staff and remove public links where practical.
Review recent web and application logs for unusual requests to /_parse/_all_edits.php containing fname or lname values.

May need vendor / contractor work

What is it

This issue can allow a criminal to create a link that changes part of a page when a person opens it. It is like placing a convincing but fake instruction sheet inside your reception desk: staff may be led to take an action or reveal information while believing the message came from your system.

Who is affected

This matters to you if you use or run Job Recruitment 1.0, especially if staff or applicants open links connected to its recruitment pages. An attacker does not need an account, but someone must open the malicious link for the attack to work.

How urgent is it

A public proof-of-concept is available, making this a practical issue to put on your near-term IT work list. It is not listed in CISA's catalog of vulnerabilities known to be actively exploited, and the attack requires someone to interact with a malicious link.

What to do — in detail

Confirm whether the deployed application is Job Recruitment 1.0 and whether /_parse/_all_edits.php is reachable by users or the public. Test only in a safe environment by checking whether input supplied through fname or lname is returned to the browser without safe output encoding.

No vendor patch, fixed version, or supported upgrade path is available in the findings. Contact the maintainer or supplier for a corrected release before making version changes; do not assume an unverified replacement version fixes this issue.

If patching is delayed, restrict access to the affected pages to authenticated, trusted users where feasible, remove unnecessary public exposure, and use a web-application firewall rule to block suspicious script-like input in fname and lname. Monitor web-server and application logs for requests to /_parse/_all_edits.php with unexpected markup, encoded script content, or unusual fname/lname values.

CISA has not assigned a KEV remediation due date because this CVE is not in the KEV catalog.

Technical context

CVE-2024-12980 is rated CVSS 3.1 4.3 (Medium): AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. The reported weakness is CWE-79 cross-site scripting, with CWE-94 also listed, affecting fln_update in /_parse/_all_edits.php through fname/lname manipulation. A remote, public GitHub PoC is known; exploitation in the wild is not confirmed, and the CVE is not in CISA KEV. EPSS is 0.5% (42nd percentile) with a flat trend.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

CVSS Vector Breakdown

Exploitability

AV:NAttack Vector

Network

AC:LAttack Complexity

Low

PR:NPrivileges Required

None

UI:RUser Interaction

Required

Scope

S:UScope

Unchanged

Impact

C:NConfidentiality

None

I:LIntegrity

Low

A:NAvailability

None

Open in CVSS calculator →

Weaknesses

CWE-79 CWE-94

Affected Products

code-projects

commercialaka code-projects.org

Job RecruitmentOn-premWeb App

Web & CMS Plugins / cms-core

anisha

individual-dev

job recruitment

Web & CMS Plugins

Exploitability

1 exploit source identified

Exploit details including PoC links, Metasploit modules, and scanner templates are available after registration.

View exploit details

Is your org exposed to CVE-2024-12980?Request an assessment to establish which checks are appropriate for your systems. Check my exposure

Attack Graph

Products CVE Techniques Tactics

Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.

MITRE ATT&CK

3 techniques

Execution

Initial Access

View detailed technique mapping

References

https://vuldb.com/?id.289356

vuldb.com

https://vuldb.com/?ctiid.289356

vuldb.com

https://vuldb.com/?submit.469181

vuldb.com

and 2 more references View all →

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2024-12980 and every CVE in our database. Create a free account — no credit card required.

Create Free Account

Plain-language analysis

Impact assessment and exploitation scenario in plain English

Attack graph visualization

Interactive attack path and kill chain mapping

Exploit details & PoC links

ExploitDB, Metasploit, GitHub PoCs with direct links

Nuclei scanner templates

Ready-to-use vulnerability scanner templates

Full remediation guide

Patch instructions, workarounds, and compliance impact

Interactive AI chat

Ask questions about this vulnerability in natural language

Related vulnerabilities

Semantically similar CVEs and attack patterns

REST API & MCP access

Integrate vulnerability data into your workflows