Is there a public PoC exploit available for CVE-2026-7116?

Yes, a public proof-of-concept exploit is available for CVE-2026-7116. Prioritise patching immediately. EPSS: 0.0%.

code-projects Employee Management System CVE-2026-7116

Q: What is the CVSS score of CVE-2026-7116?

CVE-2026-7116 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25830 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-04-27 VulDB

PHP XSS

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

CVSS changed

Apr 27, 2026 - 12:22 NVD

4.3 (MEDIUM) 5.3 (MEDIUM)

Analysis Generated

Apr 27, 2026 - 12:00 vuln.today

EUVD ID Assigned

Apr 27, 2026 - 11:30 euvd

EUVD-2026-25830

Analysis Generated

Apr 27, 2026 - 11:30 vuln.today

CVE Published

Apr 27, 2026 - 10:45 nvd

LOW 2.1

DescriptionCVE.org

A security flaw has been discovered in code-projects Employee Management System 1.0. This issue affects some unknown processing of the file 370project/mark.php. Performing a manipulation results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

AnalysisAI

Cross-site scripting (XSS) in code-projects Employee Management System 1.0 allows remote attackers to inject malicious scripts via manipulation of the file 370project/mark.php. The vulnerability requires user interaction (UI:R) but can be exploited over the network without authentication. Publicly available exploit code exists and the flaw has moderate impact on integrity (CVSS 4.3).

Technical ContextAI

This is a reflected or stored cross-site scripting vulnerability (CWE-79) in a PHP-based employee management application. The vulnerable endpoint is 370project/mark.php, which fails to properly sanitize or encode user-supplied input before rendering it in HTML context. The attack vector is network-based (AV:N) with low complexity (AC:L), meaning the attacker does not need to overcome any special technical barriers. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), a common flaw in web applications that do not implement output encoding or input validation.

RemediationAI

Upgrade code-projects Employee Management System to a patched version released by the vendor - consult the official code-projects.org website for the latest security release. If immediate upgrade is not possible, implement input validation and output encoding on the mark.php endpoint: ensure all user inputs are validated against a whitelist of expected characters and properly HTML-encode all data before rendering in web pages. Additionally, configure your web application firewall (WAF) to detect and block XSS payloads targeting the 370project/mark.php endpoint. As a compensating control, restrict access to the employee management system to authenticated users within your organization and deploy Content Security Policy (CSP) headers to mitigate the impact of any injected scripts. Note that restricting access reduces attacker reach but does not eliminate the risk if internal users are social-engineered.