The vulnerability resides in the Employee Management System 1.0 in the file /empproject.php. By manipulating the ID argument, an attacker can inject arbitrary script code into the browser context, enabling remote execution of JavaScript. The injected payload can steal credentials, hijack sessions, or perform actions on behalf of the user, thereby compromising confidentiality and integrity of the system.

The affected product is code‑projects Employee Management System version 1.0. The bug is tied to the /empproject.php module; no specific patch versions are listed in the advisory. Systems running this version without a recent update are vulnerable.

The CVSS score of 5.3 indicates moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, so the probability of a large‑scale exploitation is uncertain. However, the nature of the flaw—remote cross‑site scripting via a publicly exposed URL—makes it attractive for attackers who can employ automated scanners or craft malicious links. If the exploit is already public, an attacker can directly target any exposed instance of the application.