Is there a public PoC exploit available for CVE-2026-7118?

Yes, a public proof-of-concept exploit is available for CVE-2026-7118. Prioritise patching immediately. EPSS: 0.0%.

code-projects Employee Management System CVE-2026-7118

Q: What is the CVSS score of CVE-2026-7118?

CVE-2026-7118 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25832 LOW

SQL Injection (CWE-89)

2026-04-27 VulDB

PHP SQLi

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

CVSS changed

Apr 27, 2026 - 12:22 NVD

6.3 (MEDIUM) 5.3 (MEDIUM)

Analysis Generated

Apr 27, 2026 - 12:01 vuln.today

EUVD ID Assigned

Apr 27, 2026 - 11:30 euvd

EUVD-2026-25832

Analysis Generated

Apr 27, 2026 - 11:30 vuln.today

CVE Published

Apr 27, 2026 - 11:15 nvd

LOW 2.1

DescriptionCVE.org

A security vulnerability has been detected in code-projects Employee Management System 1.0. The affected element is an unknown function of the file 370project/cancel.php. The manipulation of the argument id/token leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

SQL injection in code-projects Employee Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the id or token parameter in 370project/cancel.php, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has a publicly available proof-of-concept and CVSS score of 6.3 (medium severity) with low attack complexity, though exploitation requires valid user credentials.

Technical ContextAI

The vulnerability exists in the PHP file 370project/cancel.php, which processes user-supplied input from the id and token parameters without proper sanitization or parameterized query protection. This classic SQL injection flaw (CWE-89) occurs when untrusted input is directly concatenated into SQL queries, allowing attackers to inject arbitrary SQL code. The vulnerability affects the code-projects Employee Management System product line across affected versions, as identified by CPE cpe:2.3:a:code-projects:employee_management_system:*:*:*:*:*:*:*:*, indicating all versions in this product family are potentially vulnerable.

RemediationAI

Immediate remediation requires upgrading to a patched version of code-projects Employee Management System if available from the vendor at https://code-projects.org/. If no patched version is available, implement input validation and parameterized prepared statements in the 370project/cancel.php file to sanitize the id and token parameters before use in SQL queries. Specifically, use parameterized queries (prepared statements with bound parameters) instead of string concatenation to prevent SQL injection. As an interim compensating control, restrict access to the cancel.php functionality to only authorized administrative users through network segmentation or firewall rules blocking the 370project/ directory to non-administrative IP ranges, understanding this limits legitimate employee functionality. Additionally, enable SQL query logging and Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the id and token parameters. Monitor database audit logs for suspicious query patterns or unauthorized data access attempts. Review and strengthen authentication controls for the system to reduce the number of valid credentials in circulation.