A vulnerability in code‑projects Employee Management System 1.0 permits a remote attacker to inject unsanitized JavaScript via the ID parameter of the /eloginwel.php file. The injected script can run in the victim's browser, enabling actions such as credential theft, session hijacking, or site defacement. The flaw is rooted in insufficient input validation (CWE‑79) and may also allow server‑side code injection (CWE‑94).

The affected product is code‑projects Employee Management System version 1.0; the flaw resides in the /eloginwel.php file and may impact any deployment using this component. No other versions are explicitly listed as vulnerable.

The CVSS score is 5.3, indicating moderate severity. EPSS data is not available, so the likelihood of exploitation remains uncertain. The flaw can be triggered remotely by sending a crafted HTTP request to /eloginwel.php with a malicious ID value, and public exploit code is available. The vulnerability is not yet listed in CISA’s KEV catalog, but the presence of an active exploit demonstrates that it can be abused in the field.