Is there a public PoC exploit available for EUVD-2026-31617?

Yes, a public proof-of-concept exploit is available for EUVD-2026-31617. Prioritise patching immediately. EPSS: 0.0%.

Employee Management System EUVD-2026-31617

Q: What is the CVSS score of EUVD-2026-31617?

EUVD-2026-31617 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-9416 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-05-25 VulDB

GHSA-9r2w-vx5m-4q72

PHP XSS Employee Management System

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 12:57 vuln.today

Severity Changed

May 26, 2026 - 20:07 NVD

MEDIUM LOW

CVSS changed

May 26, 2026 - 20:07 NVD

4.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A security vulnerability has been detected in code-projects Employee Management System 1.0. This impacts an unknown function of the file /myprofile.php. Such manipulation of the argument ID leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

Reflected cross-site scripting in code-projects Employee Management System 1.0 allows remote unauthenticated attackers to inject and execute malicious JavaScript in a victim's browser by manipulating the id parameter of /myprofile.php. Exploitation requires passive user interaction (UI:P) - the victim must load a crafted URL - which constrains automated attack chains. A public proof-of-concept is confirmed available on GitHub, though the EPSS score of 0.03% (10th percentile) indicates minimal real-world exploitation activity; the vulnerability is not listed in CISA KEV.

Technical ContextAI

The affected product is code-projects Employee Management System version 1.0 (CPE: cpe:2.3:a:code-projects:employee_management_system:*:*:*:*:*:*:*:*), a PHP-based web application. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting): the id parameter supplied to /myprofile.php is reflected into the HTTP response without adequate sanitization or output encoding, enabling attacker-controlled script content to execute in the victim's browser session. The wildcard version in the CPE string suggests the full version scope is not precisely bounded beyond the confirmed 1.0 release.

RemediationAI

No vendor-released patch has been identified at time of analysis for Employee Management System 1.0. Given that code-projects.org hosts educational/demo PHP projects that may not receive active security maintenance, a vendor fix may not be forthcoming. The primary compensating control is to sanitize and HTML-encode all user-supplied input before rendering - specifically, wrapping the id parameter output in /myprofile.php with PHP's htmlspecialchars() using ENT_QUOTES; this is a targeted, low-risk code change. Deploying a WAF rule to filter XSS payloads in the id parameter of that specific endpoint can reduce exposure with minimal operational side effects. If the application is not in active production use, taking it offline entirely eliminates the attack surface. See VulDB at https://vuldb.com/vuln/365397 and the public POC at https://github.com/zzzxc643/CVE1/blob/main/EMPLOYEE_MANAGEMENT_SYSTEM/vul13.md for reproduction details that can guide targeted code remediation.