Is there a public PoC exploit available for CVE-2026-7117?

Yes, a public proof-of-concept exploit is available for CVE-2026-7117. Prioritise patching immediately. EPSS: 0.0%.

code-projects Employee Management System CVE-2026-7117

Q: What is the CVSS score of CVE-2026-7117?

CVE-2026-7117 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25831 LOW

SQL Injection (CWE-89)

2026-04-27 VulDB

PHP SQLi

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

CVSS changed

Apr 27, 2026 - 12:22 NVD

6.3 (MEDIUM) 5.3 (MEDIUM)

Analysis Generated

Apr 27, 2026 - 12:00 vuln.today

EUVD ID Assigned

Apr 27, 2026 - 11:30 euvd

EUVD-2026-25831

Analysis Generated

Apr 27, 2026 - 11:30 vuln.today

CVE Published

Apr 27, 2026 - 11:00 nvd

LOW 2.1

DescriptionCVE.org

A weakness has been identified in code-projects Employee Management System 1.0. Impacted is an unknown function of the file 370project/approve.php. Executing a manipulation of the argument id/token can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

SQL injection in code-projects Employee Management System 1.0 allows authenticated remote attackers to manipulate the id and token parameters in 370project/approve.php, enabling unauthorized database queries with low confidentiality, integrity, and availability impact. Publicly available exploit code exists and CVSS score of 6.3 reflects the attack's network accessibility despite requiring low-level authentication.

Technical ContextAI

The vulnerability resides in a PHP application (370project/approve.php) that processes user-supplied input from the id and token HTTP parameters without proper sanitization or parameterized queries. SQL injection (CWE-89) occurs when an attacker concatenates malicious SQL syntax into these parameters, which are then executed directly against the backend database. The Employee Management System's PHP backend likely constructs dynamic SQL queries by string concatenation rather than using prepared statements with bound parameters, a common legacy development pattern in open-source project templates.

RemediationAI

Immediate remediation requires upgrading to a patched version of the Employee Management System if available from code-projects.org, or implementing a Web Application Firewall (WAF) rule to detect and block SQL injection patterns in the id and token parameters of approve.php requests. If no patched version exists, apply input validation by implementing strict whitelisting for the id parameter (numeric values only) and rejecting any token input containing SQL metacharacters. Use prepared statements with parameterized queries for all database interactions, replacing string concatenation SQL construction. Additionally, restrict access to approve.php to authenticated users over HTTPS, implement principle of least privilege for the database user account running queries, and enable database query logging to detect exploitation attempts. Monitor for unusual SQL error messages in application logs, which often indicate SQLi probing.