CVE-2026-9451
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A SQL injection vulnerability has been found in Employee Management System 1.0 in the file /process/applyleaveprocess.php. The attack can be performed remotely and the exploit is publicly available.
Risk Assessment
The organization is at risk of unauthorized database access, data leakage, and potential system takeover.
Recommendation
Apply a security patch immediately to prevent SQL injection, for example by using parameterized queries.
Other vulnerabilities in Employee Management System
See all- CVE-2026-76764High
A flaw has been found in code-projects Employee Management System 1.0. The impacted element is an unknown function of the file /process/aprocess.php of the component Admin Login Endpoint. This manipulation of the argument mailuid causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.
- CVE-2026-9450Medium
A SQL injection vulnerability has been found in Employee Management System 1.0 in the file /psubmit.php. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-9449Medium
A SQL injection vulnerability has been found in Employee Management System 1.0 in the file /changepassemp.php. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-9448Medium
XSS vulnerability in /applyleave.php in Employee Management System 1.0. Manipulation of the ID argument leads to cross-site scripting.
Original NVD description (English source)
A weakness has been identified in code-projects Employee Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /process/applyleaveprocess.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.