CVE-2026-9449
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A SQL injection vulnerability has been found in Employee Management System 1.0 in the file /changepassemp.php. The attack can be performed remotely and the exploit is publicly available.
Risk Assessment
The organization is at risk of unauthorized database access, data leakage, and potential system takeover.
Recommendation
Apply a security patch immediately to prevent SQL injection, for example by using parameterized queries.
Other vulnerabilities in Employee Management System
See all- CVE-2026-76764High
A flaw has been found in code-projects Employee Management System 1.0. The impacted element is an unknown function of the file /process/aprocess.php of the component Admin Login Endpoint. This manipulation of the argument mailuid causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.
- CVE-2026-9451Medium
A SQL injection vulnerability has been found in Employee Management System 1.0 in the file /process/applyleaveprocess.php. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-9450Medium
A SQL injection vulnerability has been found in Employee Management System 1.0 in the file /psubmit.php. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-9448Medium
XSS vulnerability in /applyleave.php in Employee Management System 1.0. Manipulation of the ID argument leads to cross-site scripting.
Original NVD description (English source)
A vulnerability was identified in code-projects Employee Management System 1.0. This impacts an unknown function of the file /changepassemp.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.