Is there a public PoC exploit available for CVE-2026-9417?

Yes, a public proof-of-concept exploit is available for CVE-2026-9417. Prioritise patching immediately. EPSS: 0.0%.

Employee Management System CVE-2026-9417

Q: What is the CVSS score of CVE-2026-9417?

CVE-2026-9417 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31622 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-05-25 VulDB

GHSA-gjmc-3fv5-vpgr

PHP XSS Employee Management System

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:11 vuln.today

Severity Changed

May 26, 2026 - 20:07 NVD

MEDIUM LOW

CVSS changed

May 26, 2026 - 20:07 NVD

4.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability was detected in code-projects Employee Management System 1.0. Affected is an unknown function of the file /myprofileup.php. Performing a manipulation of the argument ID results in cross site scripting. The attack is possible to be carried out remotely. The exploit is now public and may be used.

AnalysisAI

Cross-site scripting in code-projects Employee Management System 1.0 allows remote, unauthenticated attackers to inject malicious scripts via the ID parameter of /myprofileup.php, requiring only passive user interaction to execute. A publicly available proof-of-concept exploit exists on GitHub, though EPSS at 0.03% (10th percentile) and SSVC's 'not automatable' rating indicate minimal observed real-world exploitation activity. The vulnerability is limited to partial integrity impact on the vulnerable system with no confidentiality or availability impact, consistent with the CVSS 4.0 score of 2.1.

Technical ContextAI

The affected component is a PHP-based employee management web application (cpe:2.3:a:code-projects:employee_management_system:*:*:*:*:*:*:*:*) developed by code-projects.org. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning the application fails to sanitize or HTML-encode user-supplied input in the ID parameter before including it in the HTTP response rendered by the browser. This is a classic reflected or stored XSS pattern in a PHP endpoint (/myprofileup.php), where unsanitized GET or POST parameter values are written directly into the DOM without escaping, enabling script injection into the victim's browser session.

RemediationAI

No vendor-released patch has been identified at time of analysis for code-projects Employee Management System 1.0. As a primary compensating control, developers should apply output encoding to the ID parameter in /myprofileup.php before rendering it in HTML responses - in PHP this means using htmlspecialchars() with ENT_QUOTES and the correct character encoding; this directly neutralizes the injection vector with no functional trade-off. Deploying a Web Application Firewall with XSS detection rules can provide defense-in-depth but introduces false-positive risk and does not fix the underlying flaw. Restricting access to /myprofileup.php to authenticated internal users only would significantly reduce the attack surface given the PR:N vector, though this requires network-level or application-level access controls. References: https://vuldb.com/vuln/365398 and https://nvd.nist.gov/vuln/detail/CVE-2026-9417.