A vulnerability exists in the Employee Management System’s /myprofile.php, where manipulating the ID argument can lead to a cross‑site scripting injection. This flaw allows an attacker to embed arbitrary JavaScript that will run in the victim’s browser when the page is viewed, potentially hijacking sessions, defacing content, or executing further phishing actions. The weakness aligns with CWE‑79 (XSS) and, due to the code‑execution nature, also reflects aspects of CWE‑94 (Code Injection).

The flaw has been confirmed in code‑projects Employee Management System version 1.0. No impact certainty is established for other releases, and the vendor has not disclosed a fix or a newer version in the available data.

The CVSS score of 5.3 places this vulnerability in the medium severity range, and it is not listed in the CISA KEV catalog. EPSS information is unavailable, but the described remote exploit path—sending a crafted ID parameter to a publicly accessible URL—implies that a remote attacker can trigger the vulnerability from anywhere with network connectivity to the affected server. The lack of a publicly available patch increases the urgency for mitigation.