CVE-2026-9448 - code-projects Employee Management System applyleave.php cross site scripting

Back Back to CVE browser

MEDIUM

code-projects Employee Management System applyleave.php cross site scripting

Published May 25, 2026

5.3

MEDIUM

CVSS 4.0

EPSS 0.45%

Description

A vulnerability was determined in code-projects Employee Management System 1.0. This affects an unknown function of the file /applyleave.php. Executing a manipulation of the argument ID can lead to cross site scripting. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

Affected products

Vendor Code-Projects Product Employee Management System Default
n/a
- Version
  1.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Code-Projects

Employee Management System

n/a

Version	Status	Constraints
1.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-79

Cross-site Scripting (XSS)

CWE-94

Code Injection

References (6)

https://code-projects.org/
product
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-31664
Advisory
https://github.com/zzzxc643/CVE1/blob/main/EMPLOYEE_MANAGEMENT_SYSTEM/vul19.md
exploit
https://vuldb.com/submit/813704
third-party-advisory
https://vuldb.com/vuln/365429
vdb-entrytechnical-description
https://vuldb.com/vuln/365429/cti
signaturepermissions-required

Link	Providers	Tags
https://code-projects.org/		product
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-31664		Advisory
https://github.com/zzzxc643/CVE1/blob/main/EMPLOYEE_MANAGEMENT_SYSTEM/vul19.md		exploit
https://vuldb.com/submit/813704		third-party-advisory
https://vuldb.com/vuln/365429		vdb-entrytechnical-description
https://vuldb.com/vuln/365429/cti		signaturepermissions-required