Is CVE-2026-9415 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9415 being exploited in the wild.

How severe is CVE-2026-9415?

Medium severity, with a CVSS score of 4.3, published 25 May 2026.

Is there a fix for CVE-2026-9415?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-9415 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-9415?

Check whether you run Code-Projects Employee Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9415: code-projects Employee Management System reflected XSS in eloginwel.php

CVE-2026-9415 · Severity: medium · CVSS 4.3 · Published 2026-05-25

The Employee Management System by code-projects is a web application used for managing staff records and internal operations. A security vulnerability in the system's login and navigation component allows attackers to execute malicious scripts in the browsers of legitimate users. If an employee or administrator clicks a specially crafted link, an attacker could potentially steal login sessions, perform unauthorized actions on their behalf, or display fraudulent information.

Technologies: Code-Projects Employee Management System. Vendors: Code-Projects.

Quick answers

Is CVE-2026-9415 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9415 being exploited in the wild.
How severe is CVE-2026-9415?: Medium severity, with a CVSS score of 4.3, published 25 May 2026.
Which products and versions are affected?: Code-Projects Employee Management System 1.0.
Is there a fix for CVE-2026-9415?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-9415 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-9415?: Check whether you run Code-Projects Employee Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A reflected cross-site scripting (XSS) vulnerability exists in code-projects Employee Management System 1.0 within the file /eloginwel.php. The vulnerability is caused by the application failing to properly sanitize or HTML-escape the 'id' GET parameter before reflecting it into the 'href' attributes of navigation links (e.g., HOME, My Profile). A remote attacker can exploit this by crafting a malicious URL containing a JavaScript payload. When a victim visits this URL, the payload executes in the context of their browser session, potentially allowing for session cookie theft or account takeover. A public exploit (PoC) has been disclosed.

Affected products

code-projects Employee Management System 1.0

Timeline

2026-05-25: advisory: NVD publication date
2026-05-24: disclosed: Public exploit/PoC released on GitHub

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.