Executive brief
The Employee Management System, a software used for managing staff records and profiles, contains a security flaw that allows for cross-site scripting (XSS). An attacker can trick a user into clicking a malicious link, which then executes unauthorized code in the user's web browser. This could lead to the theft of login sessions, unauthorized access to employee data, or the display of fraudulent information on the management portal.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in code-projects Employee Management System 1.0 within the 'myprofile.php' component. The vulnerability is caused by improper neutralization of user-supplied input in the 'id' GET parameter, which is subsequently rendered into HTML attributes (such as navigation links and hidden input fields) without adequate escaping. A remote attacker can exploit this by crafting a malicious URL containing a JavaScript payload. If a victim visits this URL, the script executes in their browser context, potentially allowing for session cookie theft, account takeover, or DOM manipulation. A public exploit (Proof of Concept) has been disclosed.
Affected products
- code-projects Employee Management System 1.0
Timeline
- 2026-05-24: disclosed: Public exploit/POC published on GitHub
- 2026-05-25: advisory: NVD publication date