Is there a public PoC exploit available for CVE-2026-9415?

Yes, a public proof-of-concept exploit is available for CVE-2026-9415. Prioritise patching immediately. EPSS: 0.0%.

Employee Management System CVE-2026-9415

Q: What is the CVSS score of CVE-2026-9415?

CVE-2026-9415 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31618 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-05-25 VulDB

GHSA-g4gr-rvff-wxc6

PHP XSS Employee Management System

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:10 vuln.today

Severity Changed

May 26, 2026 - 20:07 NVD

MEDIUM LOW

CVSS changed

May 26, 2026 - 20:07 NVD

4.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A weakness has been identified in code-projects Employee Management System 1.0. This affects an unknown function of the file /eloginwel.php. This manipulation of the argument ID causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

Reflected cross-site scripting in code-projects Employee Management System 1.0 allows remote unauthenticated attackers to inject and execute malicious scripts in a victim's browser via the ID parameter of /eloginwel.php. Exploitation requires user interaction (UI:P per CVSS 4.0), limiting automatable mass exploitation, though a publicly available proof-of-concept lowers the technical bar for targeted attacks. No vendor patch has been identified at time of analysis, and the EPSS score of 0.03% (10th percentile) indicates low observed exploitation probability despite POC availability.

Technical ContextAI

The affected product is a PHP-based Employee Management System (CPE: cpe:2.3:a:code-projects:employee_management_system:*:*:*:*:*:*:*:*) developed by code-projects.org, version 1.0. The vulnerability is a CWE-79 (Improper Neutralization of Input During Web Page Generation) flaw, meaning the application fails to sanitize or encode user-supplied input before reflecting it into HTTP responses. Specifically, the ID argument passed to /eloginwel.php - likely a login or welcome page endpoint - is rendered in the browser without proper output encoding, enabling script injection. This is a classic reflected XSS pattern common in PHP applications that construct HTML output by concatenating raw GET/POST parameters without htmlspecialchars() or equivalent escaping.

RemediationAI

No vendor-released patch has been identified at time of analysis; code-projects has not published a fix or advisory. As a primary compensating control, input to the ID parameter of /eloginwel.php should be validated server-side and all user-supplied data must be HTML-encoded before output using PHP's htmlspecialchars() with ENT_QUOTES - this directly neutralizes the injection vector without requiring application restructuring. A web application firewall (WAF) rule blocking common XSS payloads (script tags, event handlers) in GET/POST parameters can reduce exposure, though it adds maintenance overhead and may introduce false positives. If the /eloginwel.php endpoint is not required for external-facing access, restricting it to internal network ranges via server or firewall ACLs eliminates the remote attack surface entirely at the cost of limiting legitimate remote access. Monitoring application logs for XSS probe patterns (e.g., alert(), document.cookie in query strings) can aid detection. See https://vuldb.com/vuln/365396 and the POC at https://github.com/zzzxc643/CVE1/blob/main/EMPLOYEE_MANAGEMENT_SYSTEM/vul12.md for technical detail to inform defensive rule writing.