The vulnerability exists in the /changepassemp.php script of code‑projects Employee Management System 1.0, where manipulation of the ID argument allows unsanitized data to be reflected back in the page, enabling a classic client‑side cross site scripting flaw. Attackers can craft a malicious URL with injected script, which is then executed in the victim’s browser when the page is loaded, potentially allowing theft of session cookies, unauthorized access, or navigation to phishing sites. The weakness corresponds to CWE‑79, reflecting the lack of proper output encoding and input validation. The impact is limited to the victim’s browser session and data, but it can be leveraged by attackers to compromise user accounts and perform social engineering attacks.

Affected product: code‑projects Employee Management System version 1.0. No other versions or vendors were listed as impacted.

The CVSS score of 5.3 denotes moderate severity, with an existence of a published exploit and the ability to be delivered from remote. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation at the time of reporting. Nonetheless, because the flaw can be triggered by a crafted URL and does not require local privileges, the risk remains significant for exposed installations.