CVE-2026-9415
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A Cross-Site Scripting (XSS) vulnerability was identified in code-projects Employee Management System 1.0 in an unknown function of /eloginwel.php via the ID argument. Remote attack is possible, and the exploit is public.
Risk Assessment
An attacker can remotely inject a malicious script that executes in the victim's browser, potentially leading to data theft or session hijacking.
Recommendation
Update the system or apply a patch to prevent XSS, such as input validation.
Other vulnerabilities in code-projects Employee Management System
See all- CVE-2026-9419Medium
A Cross-Site Scripting (XSS) vulnerability was found in code-projects Employee Management System 1.0 in an unknown function of /empproject.php via the ID argument. Remote attack is possible, and the exploit is public.
- CVE-2026-9418Medium
A Cross-Site Scripting (XSS) vulnerability was detected in code-projects Employee Management System 1.0 in an unknown function of /changepassemp.php via the ID argument. Remote attack is possible, and the exploit is public.
- CVE-2026-9417Medium
A Cross-Site Scripting (XSS) vulnerability was detected in code-projects Employee Management System 1.0 in an unknown function of /myprofileup.php via the ID argument. Remote attack is possible, and the exploit is public.
- CVE-2026-9416Medium
A Cross-Site Scripting (XSS) vulnerability was detected in code-projects Employee Management System 1.0 in an unknown function of /myprofile.php via the ID argument. Remote attack is possible, and the exploit is public.
Original NVD description (English source)
A weakness has been identified in code-projects Employee Management System 1.0. This affects an unknown function of the file /eloginwel.php. This manipulation of the argument ID causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.