# CVE-2026-38569: StratonWebDesigners HireFlow stored XSS in candidate_detail.html

Source: https://junglewise.ai/threats/cve-2026-38569-stratonwebdesigners-hireflow-stored-xss-in-candidate-detail-html  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-11. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-38569 · Severity: info · CVSS 0 · Published 2026-05-11

HireFlow, an interview management system used by recruiters to track candidates and schedule interviews, is vulnerable to a security flaw where malicious scripts can be injected into candidate profiles. An attacker can submit a specially crafted resume or feedback comment that, when viewed by a recruiter or administrator, executes unauthorized code in their browser. This could lead to the theft of session cookies, unauthorized access to sensitive recruitment data, or the performance of actions on behalf of the logged-in user.

Technologies: [StratonWebDesigners HireFlow](https://junglewise.ai/threats/technologies/hireflow). Vendors: [StratonWebDesigners](https://junglewise.ai/threats/vendors/stratonwebdesigners).

## Quick answers

**Is CVE-2026-38569 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-38569 being exploited in the wild.

**How severe is CVE-2026-38569?** Informational severity, with a CVSS score of 0, published 11 May 2026.

**Which products and versions are affected?** StratonWebDesigners HireFlow 1.2.

**Is there a fix for CVE-2026-38569?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-38569 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-38569?** Check whether you run StratonWebDesigners HireFlow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in HireFlow v1.2 within the candidate_detail.html component. The application fails to properly sanitize user-supplied input in the 'Resume' and 'Feedback Comment' fields during POST requests to /candidates/add or /feedback/add. An attacker can inject malicious JavaScript into these fields, which is then stored in the database and executed in the context of any user (such as an HR manager or admin) who views the affected candidate's detail page. This can be used to hijack sessions or exfiltrate sensitive candidate information. While a patch for a related IDOR issue is mentioned for v1.3, users should ensure all inputs are properly escaped using Jinja2 or similar templating engines.

## Affected products

- StratonWebDesigners HireFlow 1.2

## Timeline

- 2026-05-11: disclosed: CVE published to NVD

## References

- [https://github.com/StratonWebDesigners/HireFlow](https://github.com/StratonWebDesigners/HireFlow)
- [https://github.com/hijackedamygdala/CVE-Disclosures/tree/main/HireFlow/CVE-2026-38569](https://github.com/hijackedamygdala/CVE-Disclosures/tree/main/HireFlow/CVE-2026-38569)
- [https://www.sourcecodester.com/python/18688/hireflow-%E2%80%93-complete-interview-management-system.html](https://www.sourcecodester.com/python/18688/hireflow-%E2%80%93-complete-interview-management-system.html)

## Related threats

- [StratonWebDesigners HireFlow authentication bypass via hard-coded secret key](https://junglewise.ai/threats/cve-2026-45336-stratonwebdesigners-hireflow-authentication-bypass-via-hard-coded)
- [StratonWebDesigners HireFlow IDOR in candidate and interview endpoints](https://junglewise.ai/threats/cve-2026-38568-stratonwebdesigners-hireflow-idor-in-candidate-and-interview)
- [StratonWebDesigners HireFlow SQL injection in login and search endpoints](https://junglewise.ai/threats/cve-2026-38567-stratonwebdesigners-hireflow-sql-injection-in-login-and-search)
- [StratonWebDesigners HireFlow CSRF in multiple endpoints](https://junglewise.ai/threats/cve-2026-38566-stratonwebdesigners-hireflow-csrf-in-multiple-endpoints)