CVE-2026-9448
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
XSS vulnerability in /applyleave.php in Employee Management System 1.0. Manipulation of the ID argument leads to cross-site scripting.
Risk Assessment
A remote attacker can inject malicious scripts, potentially leading to session theft or account takeover.
Recommendation
Implement input validation and encoding for the ID argument and consider using Content Security Policy.
Other vulnerabilities in Employee Management System
See all- CVE-2026-76764High
A flaw has been found in code-projects Employee Management System 1.0. The impacted element is an unknown function of the file /process/aprocess.php of the component Admin Login Endpoint. This manipulation of the argument mailuid causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.
- CVE-2026-9451Medium
A SQL injection vulnerability has been found in Employee Management System 1.0 in the file /process/applyleaveprocess.php. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-9450Medium
A SQL injection vulnerability has been found in Employee Management System 1.0 in the file /psubmit.php. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-9449Medium
A SQL injection vulnerability has been found in Employee Management System 1.0 in the file /changepassemp.php. The attack can be performed remotely and the exploit is publicly available.
Original NVD description (English source)
A vulnerability was determined in code-projects Employee Management System 1.0. This affects an unknown function of the file /applyleave.php. Executing a manipulation of the argument ID can lead to cross site scripting. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.