CVE-2024-12980

code-projects Job Recruitment _all_edits.php fln_update cross site scripting

Public exploit available. Not confirmed exploited in the wild yet. No fix published yet.

CVSS 3.14.3Medium EPSS percentile41st0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 1 source FixNone yetNo fix or workaround published

Published 2024-12-27Updated 2025-02-18Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether you run Job Recruitment 1.0 and whether users can access its recruitment pages.
Ask your software vendor whether a supported update or corrected release is available; no fixed version has been published.
Until a fix is available, limit access to the affected recruitment pages to trusted staff and remove public links where practical.
Review recent web and application logs for unusual requests to /_parse/_all_edits.php containing fname or lname values.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A vulnerability was found in code-projects Job Recruitment 1.0. It has been classified as problematic. Affected is the function fln_update of the file /_parse/_all_edits.php. The manipulation of the argument fname/lname leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

In plain language

Written by AI from the record

Job Recruitment 1.0 has a flaw that can let a malicious link alter what a user sees; small businesses using it should address it soon because a public attack example exists.

Unauthenticated reflected XSS in Job Recruitment 1.0 through the fname/lname parameters handled by fln_update in /_parse/_all_edits.php.

If you're affected

Staff account actions
Recruitment data exposure
Fraudulent-looking pages
Hiring workflow disruption

What is it

This issue can allow a criminal to create a link that changes part of a page when a person opens it. It is like placing a convincing but fake instruction sheet inside your reception desk: staff may be led to take an action or reveal information while believing the message came from your system.

Who is affected

This matters to you if you use or run Job Recruitment 1.0, especially if staff or applicants open links connected to its recruitment pages. An attacker does not need an account, but someone must open the malicious link for the attack to work.

How urgent is it

A public proof-of-concept is available, making this a practical issue to put on your near-term IT work list. It is not listed in CISA's catalog of vulnerabilities known to be actively exploited, and the attack requires someone to interact with a malicious link.

What to do — in detail

Confirm whether the deployed application is Job Recruitment 1.0 and whether /_parse/_all_edits.php is reachable by users or the public. Test only in a safe environment by checking whether input supplied through fname or lname is returned to the browser without safe output encoding.

No vendor patch, fixed version, or supported upgrade path is available in the findings. Contact the maintainer or supplier for a corrected release before making version changes; do not assume an unverified replacement version fixes this issue.

If patching is delayed, restrict access to the affected pages to authenticated, trusted users where feasible, remove unnecessary public exposure, and use a web-application firewall rule to block suspicious script-like input in fname and lname. Monitor web-server and application logs for requests to /_parse/_all_edits.php with unexpected markup, encoded script content, or unusual fname/lname values.

CISA has not assigned a KEV remediation due date because this CVE is not in the KEV catalog.

Technical context

CVE-2024-12980 is rated CVSS 3.1 4.3 (Medium): AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. The reported weakness is CWE-79 cross-site scripting, with CWE-94 also listed, affecting fln_update in /_parse/_all_edits.php through fname/lname manipulation. A remote, public GitHub PoC is known; exploitation in the wild is not confirmed, and the CVE is not in CISA KEV. EPSS is 0.5% (42nd percentile) with a flat trend.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS41st

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 41st percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

5 events over 434 days, from the signal feeds we watch.

2026-03-06Public exploit / PoCsource: github-poc
2025-02-18Record updated
2024-12-27Publishedweakness classified, att&ck mapped

Affected products

code-projectscommercialaka code-projects.org
- Job RecruitmentWeb AppOn-premWeb & CMS Plugins / cms-core
anishaindividual-dev
- job recruitmentWeb & CMS Plugins

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Scored 4.3 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality NoneNo confidentiality impact
Integrity LowData modification is possible but limited in scope or consequence
Availability NoneNo availability impact

Weaknesses

ATT&CK techniques

Mapped from the weaknesses above (CWE to ATT&CK), not observed in attacks.

Sources

References in the record

And 2 more references. See all after sign-in

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Job Recruitment, not every advisory. This one: public exploit.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account