CVE-2019-18221

CVE-2019-18221 describes a stored Cross-Site Scripting (XSS) vulnerability in CoreHR Core Portal versions prior to 27.0.7. This medium-severity flaw (CVSS 6.1) allows an unauthenticated attacker to inject malicious scripts into the application, which would then execute in a victim's browser upon viewing the compromised content, potentially leading to information disclosure or unauthorized actions. While the attack complexity is low, it requires user interaction (UI:R). There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.