Description
A security vulnerability has been detected in code-projects Employee Leave Managing System 1.0. Affected is an unknown function of the file /EmpManageSys/editaction.php of the component Employee Profile Update. The manipulation of the argument Name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
Published: 2026-08-31
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑Site Scripting (XSS) in the Name field of editaction.php that can inject malicious scripts when accessed remotely
Action: Patch
AI Analysis

Impact

An attacker can craft a URL or form submission that supplies a malicious payload in the Name parameter. The application reflects this value back to the browser without proper encoding, allowing the payload to execute JavaScript in the context of a victim’s browser. This type of vulnerability is a classic XSS flaw and corresponds to CWE‑79. The impact may include session hijacking, defacement, or theft of sensitive data accessed by the victim.

Affected Systems

The affected product is code‑projects Employee Leave Managing System version 1.0. The vulnerability resides in the editaction.php component of the Employee Profile Update feature. Only the Name parameter is impacted; no other input fields or modules are reported to be affected.

Risk and Exploitability

The CVSS score of 5.1 indicates moderate severity. The EPSS score is not available, but the vulnerability has been publicly disclosed and is known to be exploitable remotely. It is not currently listed in CISA’s KEV catalog. Attackers can trigger the flaw by accessing a URL or submitting a form that includes a malicious Name value, without needing additional prerequisites or elevated privileges.

Generated by OpenCVE AI on August 31, 2026 at 07:52 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest patch or update to code‑projects Employee Leave Managing System if the vendor releases a fix for the XSS issue
  • Modify editaction.php to encode or escape all user‑supplied values, especially the Name parameter, before rendering them in the browser (e.g., using htmlspecialchars or a framework’s output encoder)
  • Configure the web server or application to send a Content‑Security‑Policy header that restricts inline script execution and limits script sources to trusted domains

Generated by OpenCVE AI on August 31, 2026 at 07:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 31 Aug 2026 06:45:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in code-projects Employee Leave Managing System 1.0. Affected is an unknown function of the file /EmpManageSys/editaction.php of the component Employee Profile Update. The manipulation of the argument Name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
Title code-projects Employee Leave Managing System Employee Profile Update editaction.php cross site scripting
First Time appeared Code-projects
Code-projects employee Leave Managing System
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:code-projects:employee_leave_managing_system:*:*:*:*:*:*:*:*
Vendors & Products Code-projects
Code-projects employee Leave Managing System
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Employee Leave Managing System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-31T22:03:38.952Z

Reserved: 2026-08-30T08:01:56.184Z

Link: CVE-2026-82622

cve-icon Vulnrichment

Updated: 2026-08-31T21:50:26.799Z

cve-icon NVD

Status : Deferred

Published: 2026-08-31T07:17:46.533

Modified: 2026-08-31T22:17:28.003

Link: CVE-2026-82622

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T21:21:58Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')