Is there a public PoC exploit available for CVE-2026-9449?

Yes, a public proof-of-concept exploit is available for CVE-2026-9449. Prioritise patching immediately. EPSS: 0.0%.

Employee Management System CVE-2026-9449

Q: What is the CVSS score of CVE-2026-9449?

CVE-2026-9449 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31665 LOW

SQL Injection (CWE-89)

2026-05-25 VulDB

GHSA-2cr2-92rw-9rp5

PHP SQLi Employee Management System

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:16 vuln.today

Severity Changed

May 26, 2026 - 20:07 NVD

MEDIUM LOW

CVSS changed

May 26, 2026 - 20:07 NVD

6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability was identified in code-projects Employee Management System 1.0. This impacts an unknown function of the file /changepassemp.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in code-projects Employee Management System 1.0 exposes the /changepassemp.php password-change endpoint to database manipulation by authenticated low-privilege users over the network. The CVSS 4.0 score of 2.1 reflects limited, non-cascading impact - partial confidentiality, integrity, and availability degradation confined to the vulnerable component with no downstream system scope change. A publicly available proof-of-concept exploit exists on GitHub, though the EPSS score of 0.03% (8th percentile) and SSVC 'automatable: no' classification indicate this is unlikely to see widespread opportunistic exploitation; no public exploit identified at time of analysis corroborating active KEV-level campaigns.

Technical ContextAI

The affected application is a PHP-based web system identified by CPE cpe:2.3:a:code-projects:employee_management_system:*:*:*:*:*:*:*:*. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), occurring in /changepassemp.php - the employee password-change handler. This PHP file likely constructs SQL queries by directly concatenating user-supplied input (such as an employee ID or current password field) without using parameterized queries or prepared statements, allowing an attacker to alter query logic. The PHP + MySQL stack typical of code-projects applications makes PDO or MySQLi bound parameters the canonical remediation path.

RemediationAI

No vendor-released patch has been identified at the time of analysis - the code-projects vendor site (https://code-projects.org/) provides no documented fixed version in available references. The definitive fix is to rewrite SQL queries in /changepassemp.php using PHP PDO or MySQLi prepared statements with bound parameters, eliminating the injection surface entirely. As an immediate compensating control, deploy a Web Application Firewall rule targeting SQL injection payloads on the /changepassemp.php endpoint; note that WAF bypass is possible and this is not a permanent solution. Restrict network access to the application to only trusted internal networks or VPN-authenticated users, reducing the effective attack surface given that PR:L authentication is already required. If the password-change feature is non-critical or infrequently used, consider temporarily disabling /changepassemp.php at the web server level (e.g., via nginx location deny or Apache FilesMatch) until a code fix is applied.