code-projects Employee Management System 1.0 contains an unknown function in the file approve.php that accepts an id or token argument without proper validation. The lack of validation allows a malicious user to construct input that is incorporated directly into a SQL statement, resulting in an injected query. This flaw falls under CWE-74 and CWE-89 and can let an attacker read or modify database contents, giving unauthorized access to employee data and potentially other sensitive information.

The affected product is code-projects Employee Management System version 1.0. The specific vulnerability is related to the approve.php endpoint, which is part of the core application logic for approving employee-related actions.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation at this time. However, the vulnerability is publicly documented and the exploit code is available, meaning that a determined attacker could discover and use it remotely by sending crafted requests to approve.php. The flaw is not listed in the CISA KEV catalog, but its remote nature and injection capability remain significant concerns.