Executive brief
HireFlow, an interview management system used by recruiters to track candidates and schedule interviews, is vulnerable to a security flaw where malicious scripts can be injected into candidate profiles. An attacker can submit a specially crafted resume or feedback comment that, when viewed by a recruiter or administrator, executes unauthorized code in their browser. This could lead to the theft of session cookies, unauthorized access to sensitive recruitment data, or the performance of actions on behalf of the logged-in user.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in HireFlow v1.2 within the candidate_detail.html component. The application fails to properly sanitize user-supplied input in the 'Resume' and 'Feedback Comment' fields during POST requests to /candidates/add or /feedback/add. An attacker can inject malicious JavaScript into these fields, which is then stored in the database and executed in the context of any user (such as an HR manager or admin) who views the affected candidate's detail page. This can be used to hijack sessions or exfiltrate sensitive candidate information. While a patch for a related IDOR issue is mentioned for v1.3, users should ensure all inputs are properly escaped using Jinja2 or similar templating engines.
Affected products
- StratonWebDesigners HireFlow 1.2
Timeline
- 2026-05-11: disclosed: CVE published to NVD