CVE-2025-14193
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
A vulnerability was determined in code-projects Employee Profile Management System 1.0. This vulnerability affects unknown code of the file /view_personnel.php. Executing a manipulation of the argument per_id can lead to SQL injection. The attack can be launched remotely, and the exploit has been publicly disclosed.
Risk Assessment
The risk includes unauthorized access to the database, theft or modification of employee personal data. This can lead to confidentiality and integrity breaches.
Recommendation
Immediately update the system or apply vendor patches. Also use parameterized SQL queries and validate input data.
Other vulnerabilities in Employee Profile Management System
See all- CVE-2025-14222Medium
A flaw has been found in code-projects Employee Profile Management System 1.0. Affected is an unknown function of the file /print_personnel_report.php. This manipulation of the argument per_id causes SQL injection. The attack may be initiated remotely, and the exploit has been published and may be used.
- CVE-2025-14195Medium
A security flaw was discovered in code-projects Employee Profile Management System 1.0 allowing unrestricted file upload. Manipulating the per_file argument in /profiling/add_file_query.php enables remote attacks. The exploit has been released publicly and may be used.
- CVE-2025-14194Low
Employee Profile Management System 1.0 by code-projects has a cross-site scripting (XSS) vulnerability in /view_personnel.php. Manipulation of arguments per_address, dr_school, or other_school leads to XSS. The attack can be performed remotely, and the exploit is publicly available.
Original NVD description (English source)
A vulnerability was determined in code-projects Employee Profile Management System 1.0. This vulnerability affects unknown code of the file /view_personnel.php. Executing a manipulation of the argument per_id can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS