Employee Management System CVE-2026-9418

The attacker must be able to deliver a crafted URL to a victim who then clicks it and loads the page in their browser - passive user interaction (UI:P) is a hard prerequisite and the primary limiting factor. The vulnerable endpoint /changepassemp.php must be network-accessible; if the application is deployed on an internal network without external exposure, the attacker must first have network access to that segment. No authentication is required for the attacker (PR:N per CVSS 4.0), meaning the crafted request can be made without any account on the system. The vulnerability is specific to Employee Management System 1.0 running on PHP; no special non-default configuration is required beyond the application being deployed and the endpoint being reachable. Exploitation impact is bounded to the victim's browser session - there is no server-side code execution or privilege escalation beyond the XSS context.

The CVSS 4.0 score of 2.1 (Low) accurately reflects the constrained real-world impact. The vector AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N confirms network reachability with no privileges required for the attacker, but mandates passive user interaction - a victim must follow a crafted URL. The scope is limited entirely to the vulnerable system with only low integrity impact and no confidentiality or availability impact. EPSS at 0.03% (10th percentile) corroborates a low exploitation probability despite the publicly available POC. The absence of a CISA KEV entry further supports that active widespread exploitation has not been confirmed. The POC and low attack complexity create a credible, repeatable exploit path, but the UI requirement, limited impact scope, and niche deployment base (a free academic-style PHP project) substantially reduce realistic risk. This is a genuine but low-priority finding unless the application is exposed to untrusted users or handles sensitive HR/credential data.

An attacker crafts a URL targeting the vulnerable /changepassemp.php endpoint with a malicious JavaScript payload embedded in the ID parameter - for example, appending a script tag or event handler - and delivers this link to an authenticated or unauthenticated user of the application via phishing or a malicious web page. When the victim clicks the link and their browser renders the page, the injected script executes in the victim's browser context, potentially hijacking session cookies, performing actions on behalf of the user, or redirecting to attacker-controlled infrastructure. A public proof-of-concept demonstrating this technique is available at https://github.com/zzzxc643/CVE1/blob/main/EMPLOYEE_MANAGEMENT_SYSTEM/vul16.md.