CVE-2026-9418
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A Cross-Site Scripting (XSS) vulnerability was detected in code-projects Employee Management System 1.0 in an unknown function of /changepassemp.php via the ID argument. Remote attack is possible, and the exploit is public.
Risk Assessment
A remote attacker can inject a malicious script that executes in the administrator's browser, potentially leading to data theft or session hijacking.
Recommendation
Update the system or apply a patch to prevent XSS, such as input validation and encoding.
Other vulnerabilities in code-projects Employee Management System
See all- CVE-2026-9419Medium
A Cross-Site Scripting (XSS) vulnerability was found in code-projects Employee Management System 1.0 in an unknown function of /empproject.php via the ID argument. Remote attack is possible, and the exploit is public.
- CVE-2026-9417Medium
A Cross-Site Scripting (XSS) vulnerability was detected in code-projects Employee Management System 1.0 in an unknown function of /myprofileup.php via the ID argument. Remote attack is possible, and the exploit is public.
- CVE-2026-9416Medium
A Cross-Site Scripting (XSS) vulnerability was detected in code-projects Employee Management System 1.0 in an unknown function of /myprofile.php via the ID argument. Remote attack is possible, and the exploit is public.
- CVE-2026-9415Medium
A Cross-Site Scripting (XSS) vulnerability was identified in code-projects Employee Management System 1.0 in an unknown function of /eloginwel.php via the ID argument. Remote attack is possible, and the exploit is public.
Original NVD description (English source)
A flaw has been found in code-projects Employee Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /changepassemp.php. Executing a manipulation of the argument ID can lead to cross site scripting. The attack may be performed from remote. The exploit has been published and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS