CVE-2026-76764
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A flaw has been found in code-projects Employee Management System 1.0. The impacted element is an unknown function of the file /process/aprocess.php of the component Admin Login Endpoint. This manipulation of the argument mailuid causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.
Risk Assessment
An attacker can exploit SQL injection to bypass authentication or gain unauthorized access to data.
Recommendation
It is recommended to upgrade the system to a patched version and use parameterized queries.
Other vulnerabilities in Employee Management System
See all- CVE-2026-9451Medium
A SQL injection vulnerability has been found in Employee Management System 1.0 in the file /process/applyleaveprocess.php. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-9450Medium
A SQL injection vulnerability has been found in Employee Management System 1.0 in the file /psubmit.php. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-9449Medium
A SQL injection vulnerability has been found in Employee Management System 1.0 in the file /changepassemp.php. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-9448Medium
XSS vulnerability in /applyleave.php in Employee Management System 1.0. Manipulation of the ID argument leads to cross-site scripting.
Original NVD description (English source)
A flaw has been found in code-projects Employee Management System 1.0. The impacted element is an unknown function of the file /process/aprocess.php of the component Admin Login Endpoint. This manipulation of the argument mailuid causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.