CVE-2026-9418
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A Cross-Site Scripting (XSS) vulnerability was detected in code-projects Employee Management System 1.0 in an unknown function of /changepassemp.php via the ID argument. Remote attack is possible, and the exploit is public.
Risk Assessment
A remote attacker can inject a malicious script that executes in the administrator's browser, potentially leading to data theft or session hijacking.
Recommendation
Update the system or apply a patch to prevent XSS, such as input validation and encoding.
Other vulnerabilities in code-projects Employee Management System
See all- CVE-2026-9419Medium
A Cross-Site Scripting (XSS) vulnerability was found in code-projects Employee Management System 1.0 in an unknown function of /empproject.php via the ID argument. Remote attack is possible, and the exploit is public.
- CVE-2026-9417Medium
A Cross-Site Scripting (XSS) vulnerability was detected in code-projects Employee Management System 1.0 in an unknown function of /myprofileup.php via the ID argument. Remote attack is possible, and the exploit is public.
- CVE-2026-9416Medium
A Cross-Site Scripting (XSS) vulnerability was detected in code-projects Employee Management System 1.0 in an unknown function of /myprofile.php via the ID argument. Remote attack is possible, and the exploit is public.
- CVE-2026-9415Medium
A Cross-Site Scripting (XSS) vulnerability was identified in code-projects Employee Management System 1.0 in an unknown function of /eloginwel.php via the ID argument. Remote attack is possible, and the exploit is public.
Original NVD description (English source)
A flaw has been found in code-projects Employee Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /changepassemp.php. Executing a manipulation of the argument ID can lead to cross site scripting. The attack may be performed from remote. The exploit has been published and may be used.