Which versions of Employee Management System are affected by CVE-2026-7063?

Code-Projects Employee Management System 1.0 contains an unauthenticated SQL injection vulnerability in the password reset function that allows remote attackers to directly access, modify, or delete…

Is there a public PoC exploit available for CVE-2026-7063?

Yes, a public proof-of-concept exploit is available for CVE-2026-7063. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-7063?

Within 24 hours: identify all systems running Code-Projects Employee Management System 1.0 and isolate affected instances from production networks; document all database access logs from the /370project/process/eprocess.php endpoint. Within 7 days: implement network-level access controls (WAF rules blocking SQL injection patterns to the pwd parameter; restrict access to /370project/process/ to authorized personnel only) and apply input validation patches if vendor releases them. Within 30 days: migrate to a supported employee management platform or apply vendor security updates if released; conduct forensic review of database modification logs since deployment; reset all employee credentials.

Employee Management System CVE-2026-7063

Q: What is the CVSS score of CVE-2026-7063?

CVE-2026-7063 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

SQL Injection (CWE-89)

2026-04-26 VulDB

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:12 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Severity Changed

Apr 26, 2026 - 23:22 NVD

HIGH MEDIUM

CVSS changed

Apr 26, 2026 - 23:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

Analysis Generated

Apr 26, 2026 - 23:15 vuln.today

Analysis Generated

Apr 26, 2026 - 22:45 vuln.today

CVE Published

Apr 26, 2026 - 22:30 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was detected in code-projects Employee Management System 1.0. This vulnerability affects unknown code of the file /370project/process/eprocess.php of the component Endpoint. Performing a manipulation of the argument pwd results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.

AnalysisAI

SQL injection in code-projects Employee Management System 1.0 allows remote unauthenticated attackers to extract, modify, or delete database contents via the pwd parameter in /370project/process/eprocess.php. CVSS 7.3 (High) with network vector and no prerequisites. Publicly available exploit code exists on GitHub, enabling immediate weaponization. No vendor-released patch identified at time of analysis. EPSS data unavailable; not listed in CISA KEV, suggesting targeted rather than widespread exploitation despite public POC.

Technical ContextAI

This is a classic SQL injection vulnerability (CWE-89) in a PHP-based web application. The affected endpoint /370project/process/eprocess.php fails to properly sanitize or parameterize the 'pwd' parameter before incorporating it into SQL queries. Based on the CPE string (cpe:2.3:a:code-projects:employee_management_system), this affects code-projects.org's Employee Management System version 1.0. SQL injection occurs when user-controllable input is concatenated directly into SQL statements, allowing attackers to break out of the intended query logic and execute arbitrary SQL commands. The PHP runtime executes these malicious queries against the backend database, typically MySQL or MariaDB in such projects. The vulnerability exists in what appears to be an employee data processing endpoint, likely used for authentication or employee record updates based on the 'pwd' (password) parameter name.

RemediationAI

No vendor-released patch identified at time of analysis from code-projects.org. Immediate compensating controls: (1) Implement parameterized queries or prepared statements in /370project/process/eprocess.php for the pwd parameter - modify source code to use PDO::prepare() or mysqli::prepare() methods instead of string concatenation; this requires PHP code changes and testing to avoid breaking authentication logic. (2) Deploy a web application firewall (WAF) with SQL injection signatures to block exploitation attempts at the network layer; configure rules to inspect POST/GET parameters for SQL metacharacters (quotes, semicolons, UNION keywords); note this is detection-based and may have bypasses. (3) Restrict network access to the application to trusted IP ranges only via firewall rules or .htaccess; this reduces attack surface but prevents legitimate remote access. (4) Consider migrating to a maintained, actively-patched employee management system from a vendor with a security disclosure program. Monitor application logs for suspicious SQL errors or unexpected database queries originating from eprocess.php. Reference the exploit details at https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/SQL%20Injection%20in%20Employee%20Management%20System%20PHP%20mailuid%20Parameter.md to understand attack patterns for detection rules.