Is there a public PoC exploit available for CVE-2026-9450?

Yes, a public proof-of-concept exploit is available for CVE-2026-9450. Prioritise patching immediately. EPSS: 0.0%.

Employee Management System CVE-2026-9450

Q: What is the CVSS score of CVE-2026-9450?

CVE-2026-9450 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31667 LOW

SQL Injection (CWE-89)

2026-05-25 VulDB

GHSA-g2pj-mrh2-7gxw

PHP SQLi Employee Management System

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:32 vuln.today

Severity Changed

May 26, 2026 - 20:07 NVD

MEDIUM LOW

CVSS changed

May 26, 2026 - 20:07 NVD

6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A security flaw has been discovered in code-projects Employee Management System 1.0. Affected is an unknown function of the file /psubmit.php. The manipulation of the argument pid results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in the /psubmit.php endpoint of code-projects Employee Management System 1.0 enables authenticated remote attackers to manipulate the pid parameter and inject arbitrary SQL commands against the backend database. A public proof-of-concept exploit has been released on GitHub, reducing the skill barrier for exploitation against unpatched deployments. Despite a low CVSS 4.0 base score of 2.1 reflecting partial impact scope and low-privilege requirements, the combination of network accessibility and public PoC warrants prompt remediation for any internet-facing instance; no public exploit identified meets CISA KEV criteria, and no vendor-released patch has been confirmed at time of analysis.

Technical ContextAI

The affected product is the PHP-based Employee Management System 1.0 by code-projects (CPE: cpe:2.3:a:code-projects:employee_management_system:*:*:*:*:*:*:*:*), a demo-grade open-source application. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), occurring in /psubmit.php where the pid parameter - likely a position or submission identifier - is incorporated into SQL queries without proper sanitization or parameterized query handling. PHP applications of this era and style commonly use direct string concatenation when building SQL queries, making them inherently susceptible to this class of injection. The wildcard CPE version field suggests NVD has not scoped the vulnerability narrowly, though ENISA EUVD explicitly identifies version 1.0 as the confirmed affected release.

RemediationAI

No vendor-released patch has been identified at time of analysis. The primary fix is to replace direct SQL string concatenation in /psubmit.php with parameterized queries or prepared statements using PHP's PDO or MySQLi extension - this eliminates the injection vector entirely with no functional trade-offs. As an immediate compensating control, input validation and allowlisting on the pid parameter (restricting it to expected numeric or alphanumeric formats) can reduce the injection surface, though this is not a substitute for parameterized queries. Deploying a web application firewall rule targeting SQL injection patterns on the /psubmit.php endpoint can provide layered defense but may generate false positives on legitimate parameter values. Restricting application access to trusted IP ranges or internal networks eliminates the network-reachable attack vector (AV:N) entirely. Organizations with no immediate path to code remediation should strongly consider taking the application offline if internet-facing. Reference the VulDB advisory at https://vuldb.com/vuln/365431 and the public PoC at https://github.com/zzzxc643/CVE1/blob/main/EMPLOYEE_MANAGEMENT_SYSTEM/vul22.md for technical reproduction detail.