Is there a public PoC exploit available for CVE-2026-9448?

Yes, a public proof-of-concept exploit is available for CVE-2026-9448. Prioritise patching immediately. EPSS: 0.0%.

Employee Management System CVE-2026-9448

Q: What is the CVSS score of CVE-2026-9448?

CVE-2026-9448 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31664 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-05-25 VulDB

GHSA-8w67-w2p7-cw33

PHP XSS Employee Management System

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:16 vuln.today

Severity Changed

May 26, 2026 - 20:07 NVD

MEDIUM LOW

CVSS changed

May 26, 2026 - 20:07 NVD

4.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability was determined in code-projects Employee Management System 1.0. This affects an unknown function of the file /applyleave.php. Executing a manipulation of the argument ID can lead to cross site scripting. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

Reflected cross-site scripting in code-projects Employee Management System 1.0 allows remote unauthenticated attackers to inject arbitrary JavaScript into victim browsers via the unsanitized id parameter in /applyleave.php. The attack requires victim interaction (UI:P per CVSS 4.0), meaning a victim must visit or be socially engineered into clicking a crafted URL. Publicly available exploit code exists on GitHub (no public exploit identified at time of analysis for widespread KEV-confirmed exploitation), though EPSS at 0.03% (10th percentile) signals negligible observed exploitation activity at scale.

Technical ContextAI

The affected application is a PHP-based Employee Management System developed by code-projects (CPE: cpe:2.3:a:code-projects:employee_management_system:*:*:*:*:*:*:*:*). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), specifically a reflected XSS variant: the id argument passed to /applyleave.php is incorporated into the HTTP response without adequate output encoding or input sanitization. Because the payload is reflected immediately in the server response rather than stored, exploitation requires delivery of a crafted URL to a target user. The application is typical of small-footprint PHP CRUD systems common in academic or internal HR deployments.

RemediationAI

No vendor-released patch identified at time of analysis - code-projects has not published a security advisory or patched release for this CVE as of the available data. As a compensating control, operators should sanitize and HTML-encode the id parameter server-side before including it in any HTTP response (trade-off: minimal, low-risk change if done correctly). Implementing a Content Security Policy (CSP) header with script-src 'self' will block inline script injection even if the parameter remains unencoded (trade-off: may break legitimate inline scripts in the application). Restricting access to /applyleave.php to authenticated internal network users via firewall or web server ACL eliminates the network-reachable attack surface entirely (trade-off: disrupts any externally-facing employee self-service workflows). Monitor VulDB entry https://vuldb.com/vuln/365429 and the code-projects repository at https://code-projects.org/ for a future patched release.