A vulnerability was identified in code-projects Employee Management System 1.0, specifically in the delete.php file. Manipulating the ID argument allows attackers to inject arbitrary SQL statements, leading to unauthorized data access, alteration, or deletion. The flaw is a classic SQL injection issue, classified under CWE-74 and CWE-89, and can compromise database confidentiality and integrity.

The affected system is code-projects Employee Management System version 1.0. No other vendor or product variants are listed, and the vulnerability resides in an unknown code section of delete.php, which is part of the employee management web application. Systems running this version without a patch are susceptible.

The CVSS score of 5.3 indicates a medium severity risk. The EPSS score is less than 1%, suggesting low current exploitation probability, and the issue is not yet listed in the CISA KEV catalog. The attack may be launched remotely, as the exploit is publicly available and might be used by attackers with network access to the web application.