The vulnerability enables an attacker to manipulate arguments passed to session_start within controller/employee.php, resulting in improper authentication. This flaw allows bypass of login checks, giving unauthorized access to employee data and potentially sensitive functionality. The weakness is classed as CWE-287.

SourceCodester Human Resource Management System version 1.0, specifically the controller/employee.php endpoint. No additional version constraints are provided, so any installation containing this component is potentially vulnerable.

The CVSS score of 6.9 indicates medium severity, and the EPSS score is unavailable, so the exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV, but publicly disclosed exploits exist and the attack can be launched remotely. Without remediation, the risk of unauthorized data exposure or privilege escalation persists.