Executive brief
The Employee Management System by code-projects is a web application used for managing staff records and internal operations. A security vulnerability in the system's login and navigation component allows attackers to execute malicious scripts in the browsers of legitimate users. If an employee or administrator clicks a specially crafted link, an attacker could potentially steal login sessions, perform unauthorized actions on their behalf, or display fraudulent information.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in code-projects Employee Management System 1.0 within the file /eloginwel.php. The vulnerability is caused by the application failing to properly sanitize or HTML-escape the 'id' GET parameter before reflecting it into the 'href' attributes of navigation links (e.g., HOME, My Profile). A remote attacker can exploit this by crafting a malicious URL containing a JavaScript payload. When a victim visits this URL, the payload executes in the context of their browser session, potentially allowing for session cookie theft or account takeover. A public exploit (PoC) has been disclosed.
Affected products
- code-projects Employee Management System 1.0
Timeline
- 2026-05-25: advisory: NVD publication date
- 2026-05-24: disclosed: Public exploit/PoC released on GitHub