A malicious user can manipulate the ID parameter in the 370project/edit.php page of code‑projects Employee Management System 1.0, causing the application to output unsanitized script content. The vulnerability allows an attacker to inject arbitrary HTML or JavaScript that is executed in the browsers of users who view the affected page. Such cross‑site scripting can lead to session hijacking, credential theft, defacement, or the delivery of further malware.

The affected product is code‑projects Employee Management System, version 1.0. The flaw resides in an unknown section of the file 370project/edit.php, which processes the ID argument supplied by the user.

The CVSS score of 5.3 indicates moderate severity; the EPSS score of < 1% suggests very low current exploitation activity, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote input via the ID parameter, and exploitation only requires a victim to visit the vulnerable page. While publicly available exploit code exists, active exploitation is currently unlikely based on the EPSS and KEV data.