CVE-2025-14194
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Employee Profile Management System 1.0 by code-projects has a cross-site scripting (XSS) vulnerability in /view_personnel.php. Manipulation of arguments per_address, dr_school, or other_school leads to XSS. The attack can be performed remotely, and the exploit is publicly available.
Risk Assessment
An attacker could inject malicious scripts, potentially leading to data theft, session hijacking, or other attacks against system users.
Recommendation
Update the system to a patched version. Sanitize input in /view_personnel.php.
Other vulnerabilities in Employee Profile Management System
See all- CVE-2025-14222Medium
A flaw has been found in code-projects Employee Profile Management System 1.0. Affected is an unknown function of the file /print_personnel_report.php. This manipulation of the argument per_id causes SQL injection. The attack may be initiated remotely, and the exploit has been published and may be used.
- CVE-2025-14195Medium
A security flaw was discovered in code-projects Employee Profile Management System 1.0 allowing unrestricted file upload. Manipulating the per_file argument in /profiling/add_file_query.php enables remote attacks. The exploit has been released publicly and may be used.
- CVE-2025-14193Medium
A vulnerability was determined in code-projects Employee Profile Management System 1.0. This vulnerability affects unknown code of the file /view_personnel.php. Executing a manipulation of the argument per_id can lead to SQL injection. The attack can be launched remotely, and the exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability was identified in code-projects Employee Profile Management System 1.0. This issue affects some unknown processing of the file /view_personnel.php. The manipulation of the argument per_address/dr_school/other_school leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly available and might be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS