Description
A flaw has been found in code-projects Employee Management System 1.0. The impacted element is an unknown function of the file /process/aprocess.php of the component Admin Login Endpoint. This manipulation of the argument mailuid causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.
Published: 2026-08-20
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the Admin Login Endpoint of code-projects Employee Management System allows an attacker to inject arbitrary SQL through the mailuid argument in /process/aprocess.php. The injection can be executed remotely over the web. The advisory does not specify the exact data impact, but the vulnerability is caused by failure to validate or sanitize the mailuid parameter and is classified as CWE-74 and CWE-89.

Affected Systems

code-projects Employee Management System is the affected product. No specific product version information is provided in the advisory.

Risk and Exploitability

The CVSS score is 6.9, indicating moderate severity. Public advisories report that an exploit has been published and is usable, but the exact exploitation likelihood is unknown. Attackers can reach the vulnerable endpoint from any remote host, making it a low-barrier remote attack vector. The specific impact of exploitation is not detailed in the advisory.

Generated by OpenCVE AI on August 20, 2026 at 08:54 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑issued patch or upgrade to the latest release of Employee Management System that sanitizes the mailuid parameter to eliminate SQL injection.
  • Restrict or disable the /process/aprocess.php admin login endpoint, if it is not required, or enforce firewall rules to block remote access.
  • Modify the application code to use prepared statements and parameterized queries for all database interactions, especially the mailuid field, to prevent injection.

Generated by OpenCVE AI on August 20, 2026 at 08:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 20 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Description A flaw has been found in code-projects Employee Management System 1.0. The impacted element is an unknown function of the file /process/aprocess.php of the component Admin Login Endpoint. This manipulation of the argument mailuid causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.
Title code-projects Employee Management System Admin Login Endpoint aprocess.php sql injection
First Time appeared Code-projects
Code-projects employee Management System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:code-projects:employee_management_system:*:*:*:*:*:*:*:*
Vendors & Products Code-projects
Code-projects employee Management System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Employee Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-20T00:00:13.051Z

Reserved: 2026-08-19T16:58:31.057Z

Link: CVE-2026-76764

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-08-20T00:16:52.983

Modified: 2026-08-20T12:48:10.287

Link: CVE-2026-76764

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T09:00:05Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')