Is there a public PoC exploit available for CVE-2026-9418?

Yes, a public proof-of-concept exploit is available for CVE-2026-9418. Prioritise patching immediately. EPSS: 0.0%.

Employee Management System CVE-2026-9418

Q: What is the CVSS score of CVE-2026-9418?

CVE-2026-9418 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31621 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-05-25 VulDB

GHSA-5w8m-fp3w-3vw8

PHP XSS Employee Management System

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:11 vuln.today

Severity Changed

May 26, 2026 - 20:07 NVD

MEDIUM LOW

CVSS changed

May 26, 2026 - 20:07 NVD

4.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A flaw has been found in code-projects Employee Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /changepassemp.php. Executing a manipulation of the argument ID can lead to cross site scripting. The attack may be performed from remote. The exploit has been published and may be used.

AnalysisAI

Reflected cross-site scripting in code-projects Employee Management System 1.0 allows remote unauthenticated attackers to inject malicious scripts into victim browsers via the unsanitized 'ID' parameter in /changepassemp.php. Exploitation requires user interaction (UI:P per CVSS 4.0), limiting mass exploitation, but a publicly available proof-of-concept exploit exists on GitHub. No patch has been identified from the vendor; EPSS of 0.03% (10th percentile) indicates low observed exploitation probability, and this CVE is not listed in the CISA KEV catalog.

Technical ContextAI

The affected product is a PHP-based Employee Management System (CPE: cpe:2.3:a:code-projects:employee_management_system:*:*:*:*:*:*:*:*) developed by code-projects.org, version 1.0. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored/Reflected XSS). Specifically, the changepassemp.php endpoint accepts an 'ID' parameter that is incorporated into page output without adequate sanitization or output encoding, enabling script injection into the rendered HTML. This is a classic reflected XSS pattern in a PHP web application lacking input validation at the parameter ingestion point and context-aware output encoding at the rendering point.

RemediationAI

No vendor-released patch has been identified at time of analysis; code-projects has not published a security advisory or fixed release. As compensating controls: sanitize and validate all user-supplied input on the server side before use, and apply context-aware output encoding (HTML entity encoding) to the 'ID' parameter before rendering in /changepassemp.php - this directly eliminates the injection point with no functional side effects. Deploying a Web Application Firewall (WAF) with XSS ruleset (e.g., OWASP ModSecurity CRS) can block common XSS payloads in transit, though WAFs can be bypassed and are not a substitute for code-level fixes. If the application is used internally, restrict access to trusted network segments or VPN to eliminate the network-reachable attack surface. Monitor VulDB (https://vuldb.com/vuln/365399) and the code-projects repository (https://code-projects.org/) for any upstream patch release.