Cross-Site Scripting Vulnerability in Code-Projects Employee Management System
CVE-2026-9448

5.3MEDIUM

Key Information:

Vendor: Code-projects
Status: Employee Management System
Vendor: CVE Published:; 25 May 2026

🔔 Create Code-projects Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-9448?

A security flaw has been identified in the code-projects Employee Management System version 1.0, specifically within the /applyleave.php file. The vulnerability arises due to improper handling of input in the argument ID, allowing an attacker to craft malicious inputs that can lead to cross-site scripting (XSS). This XSS vulnerability can be executed remotely, potentially enabling attackers to manipulate user sessions and exploit the trust of users in the running web application. Given that the exploit has been publicly disclosed, immediate attention to mitigation is advised.

Affected Version(s)

Employee Management System 1.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-9448 - Proof of Concept