Is there a public PoC exploit available for CVE-2026-7095?

Yes, a public proof-of-concept exploit is available for CVE-2026-7095. Prioritise patching immediately. EPSS: 0.0%.

code-projects Employee Management System CVE-2026-7095

Q: What is the CVSS score of CVE-2026-7095?

CVE-2026-7095 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25785 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-04-27 VulDB

PHP XSS

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

CVSS changed

Apr 27, 2026 - 08:22 NVD

4.3 (MEDIUM) 5.3 (MEDIUM)

Analysis Generated

Apr 27, 2026 - 07:45 vuln.today

EUVD ID Assigned

Apr 27, 2026 - 07:30 euvd

EUVD-2026-25785

Analysis Generated

Apr 27, 2026 - 07:30 vuln.today

CVE Published

Apr 27, 2026 - 06:30 nvd

LOW 2.1

DescriptionCVE.org

A vulnerability was identified in code-projects Employee Management System 1.0. This affects an unknown part of the file 370project/edit.php. The manipulation of the argument ID leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

AnalysisAI

Reflected cross-site scripting (XSS) in code-projects Employee Management System 1.0 allows remote unauthenticated attackers to inject malicious scripts via the ID parameter in 370project/edit.php. The vulnerability requires user interaction (link click) but has publicly available exploit code and a moderate CVSS score of 4.3, indicating limited but real integrity impact through client-side script execution.

Technical ContextAI

The vulnerability exists in a PHP-based employee management application where user-supplied input from the ID parameter is rendered in the edit.php endpoint without proper sanitization or output encoding. This is a classic reflected XSS (CWE-79) where an attacker crafts a malicious URL containing script tags or event handlers in the ID parameter, which the application echoes back to the victim's browser. The lack of input validation and HTML entity encoding allows arbitrary JavaScript execution in the victim's session context, potentially leading to session hijacking, credential theft, or malware distribution.

RemediationAI

Immediate mitigation: upgrade to a patched version of code-projects Employee Management System if available from the vendor at code-projects.org. If no patch exists, implement input validation and output encoding for the ID parameter in 370project/edit.php by using PHP's htmlspecialchars() function on all user-supplied input before rendering in HTML context. Additionally, implement a Content Security Policy (CSP) header to restrict inline script execution and deny external script sources. For defense-in-depth, enable HTTP-only and Secure flags on session cookies to mitigate session hijacking risk from successful XSS exploitation. Monitor security advisories at code-projects.org for official patch releases.