Employee Leave Managing System
Monthly
Stored cross-site scripting in code-projects Employee Leave Managing System 1.0 allows an authenticated low-privilege employee to inject persistent malicious script via the Name parameter in the Employee Profile Update endpoint (/EmpManageSys/editaction.php). When a privileged user such as an HR administrator subsequently views the tampered employee profile, the payload executes in their browser, enabling session hijacking or unauthorized administrative actions. A public proof-of-concept exploit is available on GitHub; no CISA KEV listing exists, so confirmed in-the-wild exploitation is not established at time of analysis.
Stored cross-site scripting in code-projects Employee Leave Managing System 1.0 allows an authenticated low-privilege employee to inject persistent malicious script via the Name parameter in the Employee Profile Update endpoint (/EmpManageSys/editaction.php). When a privileged user such as an HR administrator subsequently views the tampered employee profile, the payload executes in their browser, enabling session hijacking or unauthorized administrative actions. A public proof-of-concept exploit is available on GitHub; no CISA KEV listing exists, so confirmed in-the-wild exploitation is not established at time of analysis.