Is there a public PoC exploit available for EUVD-2026-31626?

Yes, a public proof-of-concept exploit is available for EUVD-2026-31626. Prioritise patching immediately. EPSS: 0.0%.

Employee Management System EUVD-2026-31626

Q: What is the CVSS score of EUVD-2026-31626?

EUVD-2026-31626 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-9419 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-05-25 VulDB

GHSA-hj9g-6j3g-57m4

PHP XSS Employee Management System

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 12:57 vuln.today

Severity Changed

May 26, 2026 - 20:07 NVD

MEDIUM LOW

CVSS changed

May 26, 2026 - 20:07 NVD

4.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability has been found in code-projects Employee Management System 1.0. Affected by this issue is some unknown functionality of the file /empproject.php. The manipulation of the argument ID leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Reflected cross-site scripting in code-projects Employee Management System 1.0 allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by manipulating the ID parameter of /empproject.php. A publicly available proof-of-concept exploit exists on GitHub, lowering the barrier to exploitation, though user interaction is required to trigger the payload. No active exploitation has been confirmed by CISA KEV, and the EPSS score of 0.03% places this in the bottom 10th percentile of exploitation likelihood, consistent with the low CVSS 4.0 score of 2.1.

Technical ContextAI

The affected product is a PHP-based web application (code-projects Employee Management System 1.0, CPE: cpe:2.3:a:code-projects:employee_management_system:*:*:*:*:*:*:*:*) widely used in academic and small-business contexts. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic reflected XSS condition in which the ID GET/POST parameter passed to /empproject.php is echoed back into the HTML response without adequate output encoding or sanitization. Because the application is PHP-based and the parameter is user-controlled, an attacker can inject script tags or event handler payloads that execute within the browser's document context for any user who follows a crafted URL. This class of vulnerability is well-understood and directly exploitable without specialized tooling.

RemediationAI

No vendor-released patch has been identified at time of analysis; the code-projects vendor has not published a security advisory or patched release. The most effective compensating control is to sanitize and HTML-encode all user-supplied input before rendering it in responses - specifically, the ID parameter in /empproject.php must be passed through an output encoding function (e.g., PHP's htmlspecialchars() with ENT_QUOTES) before inclusion in HTML context. Additionally, deploying a Content Security Policy (CSP) header with a restrictive script-src directive will significantly reduce the impact of any residual XSS by blocking inline script execution; note that overly strict CSP may break legitimate application functionality and should be tested before deployment. As a network-level control, restricting access to the application to trusted internal networks or VPN reduces the exposed attack surface without affecting functionality. The public POC is documented at https://github.com/zzzxc643/CVE1/blob/main/EMPLOYEE_MANAGEMENT_SYSTEM/vul17.md and the VulDB entry is at https://vuldb.com/vuln/365400.