A flaw in the /myprofileup.php file of the code‑projects Employee Management System allows an attacker to manipulate the ID parameter and inject arbitrary script that is executed in the victim’s browser. Based on the description, it is inferred that this vulnerability can be triggered remotely and that users who can access the page could exploit it without additional privileges. The effect is to steal session cookies, deface pages, or execute further malicious actions on behalf of the user.

code‑projects Employee Management System, released version 1.0. All installations containing the unpatched /myprofileup.php script are affected.

The CVSS score of 5.3 indicates a moderate risk; the EPSS score is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw can be triggered remotely via a manipulated ID argument, an attacker with web access can create the payload without additional privileges. No special conditions are required beyond sending a crafted request to the vulnerable page.