CVE-2025-60934

CVE-2025-60934CVE-2025-60934

Description

Multiple stored cross-site scripting (XSS) vulnerabilities in the index.php component of HR Performance Solutions Performance Pro v3.19.17 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Employee Notes, title, or description parameters. The patched version is PP-Release-6.3.2.0.

Scoring

CVSS 6.1 ()
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Last modified2026-10-27
Sourced from NVD. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.