Executive brief
A vulnerability exists in the code-projects Employee Management System, a software package used for managing staff records. An attacker can send a specially crafted link to a user that, when clicked, executes malicious scripts in their web browser. This could allow the attacker to steal login sessions, perform actions on behalf of the user, or display fraudulent information.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in code-projects Employee Management System 1.0 within the /myprofileup.php file. The application fails to properly sanitize or HTML-escape the 'id' GET parameter before embedding it into HTML attributes, specifically within navigation links and hidden input fields. A remote attacker can exploit this by crafting a malicious URL containing a JavaScript payload (e.g., using script tags or event handlers). If a victim visits this URL while authenticated, the script executes in their browser context, potentially leading to session hijacking or unauthorized account actions. A public exploit (PoC) is available.
Affected products
- code-projects Employee Management System 1.0
Timeline
- 2026-05-25: disclosed: Initial vulnerability disclosure and CVE assignment.
- 2026-05-25: advisory: VulDB and NVD published the advisory.