CVE-2026-7095

Vulnerability

The vulnerability is a reflected cross-site scripting (XSS) in the ID argument of 370project/edit.php in the code-projects Employee Management System version 1.0. The input is not properly sanitized, allowing an attacker to inject arbitrary HTML and JavaScript via the ID parameter. A sample payload "> demonstrates the issue [1].

Exploitation

The attack is remote and does not require authentication, but the victim must be tricked into clicking a crafted link. The attacker can send a malicious URL to an administrator or user with sufficient privileges. The injected script executes in the context of the victim's browser session [1].

Impact

Successful exploitation can lead to session hijacking, cookie theft, account takeover, or phishing attacks. An attacker could perform administrative actions on behalf of the victim, deface the page, or steal sensitive information. The exploit code is publicly available, increasing the risk of active attacks [1].

Mitigation

As of the publication date, no official patch has been released by code-projects. Users should apply input validation and output encoding for the ID parameter, or consider upgrading to a maintained version. The vendor's site may offer source code for review, but the application appears to be legacy and may not receive updates [1].