CVE-2026-9450
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A SQL injection vulnerability has been found in Employee Management System 1.0 in the file /psubmit.php. The attack can be performed remotely and the exploit is publicly available.
Risk Assessment
The organization is at risk of unauthorized database access, data leakage, and potential system takeover.
Recommendation
Apply a security patch immediately to prevent SQL injection, for example by using parameterized queries.
Other vulnerabilities in Employee Management System
See all- CVE-2026-76764High
A flaw has been found in code-projects Employee Management System 1.0. The impacted element is an unknown function of the file /process/aprocess.php of the component Admin Login Endpoint. This manipulation of the argument mailuid causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.
- CVE-2026-9451Medium
A SQL injection vulnerability has been found in Employee Management System 1.0 in the file /process/applyleaveprocess.php. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-9449Medium
A SQL injection vulnerability has been found in Employee Management System 1.0 in the file /changepassemp.php. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-9448Medium
XSS vulnerability in /applyleave.php in Employee Management System 1.0. Manipulation of the ID argument leads to cross-site scripting.
Original NVD description (English source)
A security flaw has been discovered in code-projects Employee Management System 1.0. Affected is an unknown function of the file /psubmit.php. The manipulation of the argument pid results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.