CVE-2026-9417
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A Cross-Site Scripting (XSS) vulnerability was detected in code-projects Employee Management System 1.0 in an unknown function of /myprofileup.php via the ID argument. Remote attack is possible, and the exploit is public.
Risk Assessment
An attacker can remotely inject a malicious script that executes in the victim's browser, potentially leading to data theft or account takeover.
Recommendation
Update the system or apply a patch to prevent XSS, such as proper input filtering.
Other vulnerabilities in code-projects Employee Management System
See all- CVE-2026-9419Medium
A Cross-Site Scripting (XSS) vulnerability was found in code-projects Employee Management System 1.0 in an unknown function of /empproject.php via the ID argument. Remote attack is possible, and the exploit is public.
- CVE-2026-9418Medium
A Cross-Site Scripting (XSS) vulnerability was detected in code-projects Employee Management System 1.0 in an unknown function of /changepassemp.php via the ID argument. Remote attack is possible, and the exploit is public.
- CVE-2026-9416Medium
A Cross-Site Scripting (XSS) vulnerability was detected in code-projects Employee Management System 1.0 in an unknown function of /myprofile.php via the ID argument. Remote attack is possible, and the exploit is public.
- CVE-2026-9415Medium
A Cross-Site Scripting (XSS) vulnerability was identified in code-projects Employee Management System 1.0 in an unknown function of /eloginwel.php via the ID argument. Remote attack is possible, and the exploit is public.
Original NVD description (English source)
A vulnerability was detected in code-projects Employee Management System 1.0. Affected is an unknown function of the file /myprofileup.php. Performing a manipulation of the argument ID results in cross site scripting. The attack is possible to be carried out remotely. The exploit is now public and may be used.