The vulnerability allows an attacker to manipulate the ID argument used by the employees' editing interface, leading to a SQL injection flaw. This could enable unauthorized retrieval, modification, or deletion of employee data stored in the database, potentially compromising confidentiality and integrity of the system. The weakness is classified as CWE-74 and CWE-89.

The affected product is code‑projects Employee Management System version 1.0. The bug resides in an undocumented section of the file edit.php which processes employee ID values. Only installations of this product and version are affected.

The CVSS score of 5.3 indicates a moderate impact, and the EPSS score of less than 1 % shows that exploitation is considered unlikely at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, as the flaw can be triggered by an external request that supplies a crafted ID parameter to edit.php, and the attack path requires web access to the affected endpoint. Public disclosure means attackers may already have code to exploit the flaw, but the low EPSS suggests there may not yet be active exploitation campaigns.