Employee Management System CVE-2026-9449

Exploitation requires a valid low-privilege authenticated session on the Employee Management System 1.0 instance, confirmed by CVSS PR:L - unauthenticated access is insufficient. The attack specifically targets the /changepassemp.php file, so the application must be network-accessible and this endpoint must not be separately restricted. No user interaction is required from a victim (UI:N), and no additional complexity beyond credential possession is needed (AC:L, AT:N). Exploitation is limited by the credential requirement (attackers must first obtain or possess a valid account), the SSVC 'automatable: no' classification (mass scanning without credentials is not viable), and the scoped impact model (SC:N/SI:N/SA:N confirms no lateral movement to connected systems is possible through this vector alone).

The CVSS 4.0 score of 2.1 is low, driven by VC:L/VI:L/VA:L with no scope change to connected systems (SC:N/SI:N/SA:N). The attack vector is network (AV:N) with low complexity (AC:L) and no additional attack requirements (AT:N), but exploitation requires low-privilege authentication (PR:L) - a real barrier that meaningfully reduces the exposed population to credentialed users only. The EPSS score of 0.03% at the 8th percentile is very low, and the vulnerability is not listed in the CISA KEV catalog, confirming no confirmed active exploitation at time of analysis. SSVC classifies it as 'automatable: no' and 'technical impact: partial,' consistent with CVSS. The key tension is between POC availability on GitHub (lowering the skill threshold for abuse) and the combined signal of low CVSS, low EPSS, no KEV listing, and the authentication prerequisite suggesting this is a low-priority finding outside of environments where untrusted users hold valid credentials.

An attacker with a low-privilege account on the Employee Management System authenticates to the application and navigates to the /changepassemp.php endpoint. They submit a crafted HTTP POST request with a SQL injection payload embedded in a form field (likely the employee ID or password parameter), manipulating the backend SQL query to enumerate database tables, extract credential hashes, or alter other employees' records. The GitHub POC at https://github.com/zzzxc643/CVE1/blob/main/EMPLOYEE_MANAGEMENT_SYSTEM/vul21.md provides a documented reproduction path, making this reproducible by low-skilled attackers who already hold application credentials.