Is there a public PoC exploit available for EUVD-2026-31666?

Yes, a public proof-of-concept exploit is available for EUVD-2026-31666. Prioritise patching immediately. EPSS: 0.0%.

Employee Management System EUVD-2026-31666

Q: What is the CVSS score of EUVD-2026-31666?

EUVD-2026-31666 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-9451 LOW

SQL Injection (CWE-89)

2026-05-25 VulDB

GHSA-cc75-hp5m-xpcj

PHP SQLi Employee Management System

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:15 vuln.today

Severity Changed

May 26, 2026 - 20:07 NVD

MEDIUM LOW

CVSS changed

May 26, 2026 - 20:07 NVD

6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A weakness has been identified in code-projects Employee Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /process/applyleaveprocess.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

SQL injection in code-projects Employee Management System 1.0 allows remote low-privileged attackers to manipulate the ID parameter in /process/applyleaveprocess.php, enabling unauthorized database read and write operations with partial impact across confidentiality, integrity, and availability. A publicly available proof-of-concept exploit exists on GitHub, though no confirmed active exploitation (CISA KEV) has been recorded. EPSS at 0.03% (8th percentile) and an SSVC assessment of 'not automatable' indicate low broad exploitation likelihood, though the accessible POC meaningfully lowers the barrier for targeted manual attacks against organizations running this application.

Technical ContextAI

The vulnerability resides in a PHP-based web application (code-projects Employee Management System 1.0, CPE: cpe:2.3:a:code-projects:employee_management_system:*:*:*:*:*:*:*:*). The affected endpoint /process/applyleaveprocess.php handles a leave application workflow and accepts an ID parameter that is passed unsanitized into a backend SQL query - a textbook CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) defect. The root cause indicates the application does not use parameterized queries or prepared statements for this input, permitting an attacker to alter the intended SQL logic by injecting arbitrary syntax through the ID value. The CVSS 4.0 vector (AV:N/AC:L/AT:N) confirms the endpoint is network-reachable with no additional attack complexity or special target configuration required beyond valid credentials.

RemediationAI

No vendor-released patch has been identified at time of analysis; monitor https://code-projects.org/ and VulDB entry https://vuldb.com/vuln/365432 for updates. As a primary compensating control, refactor /process/applyleaveprocess.php to use PHP PDO or MySQLi prepared statements with bound parameters for the ID input - this eliminates the injection vector at the code level with no functional trade-offs and is the definitive fix. As a secondary layer, deploy a WAF rule to detect and block common SQL injection patterns (e.g., UNION SELECT, OR 1=1, comment sequences) targeting the ID parameter - note this is a heuristic filter and not a substitute for code-level remediation, as obfuscated payloads may bypass signature rules. Additionally, restrict application access to internal networks or authenticated VPN sessions to reduce exposure surface; this does not eliminate insider or authenticated-attacker scenarios but aligns with the PR:L attack requirement and reduces opportunistic targeting. Audit all other parameter-handling endpoints in the application for similar unsanitized inputs, as CWE-89 defects in one endpoint often indicate systemic lack of parameterization throughout the codebase.