CVE-2025-14222
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
A flaw has been found in code-projects Employee Profile Management System 1.0. Affected is an unknown function of the file /print_personnel_report.php. This manipulation of the argument per_id causes SQL injection. The attack may be initiated remotely, and the exploit has been published and may be used.
Risk Assessment
SQL injection may allow an attacker to access sensitive employee data or modify the database, leading to a breach of information security.
Recommendation
Update the system to a version that fixes the vulnerability, or implement input validation and parameterized queries in /print_personnel_report.php.
Other vulnerabilities in Employee Profile Management System
See all- CVE-2025-14195Medium
A security flaw was discovered in code-projects Employee Profile Management System 1.0 allowing unrestricted file upload. Manipulating the per_file argument in /profiling/add_file_query.php enables remote attacks. The exploit has been released publicly and may be used.
- CVE-2025-14194Low
Employee Profile Management System 1.0 by code-projects has a cross-site scripting (XSS) vulnerability in /view_personnel.php. Manipulation of arguments per_address, dr_school, or other_school leads to XSS. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2025-14193Medium
A vulnerability was determined in code-projects Employee Profile Management System 1.0. This vulnerability affects unknown code of the file /view_personnel.php. Executing a manipulation of the argument per_id can lead to SQL injection. The attack can be launched remotely, and the exploit has been publicly disclosed.
Original NVD description (English source)
A flaw has been found in code-projects Employee Profile Management System 1.0. Affected is an unknown function of the file /print_personnel_report.php. This manipulation of the argument per_id causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS