A flaw in the change‑password functionality of the Employee Management System enables attackers to craft malicious input that is directly incorporated into SQL statements. This leads to an injection vulnerability that can expose, modify, or delete stored data when exploited. The vulnerability is limited to the SQL layer; the CVE description does not specify whether authentication is required to trigger it, but it is inferred that an unauthenticated request may be able to trigger the flaw.

The affected product is code‑projects Employee Management System version 1.0, as identified by the vendor’s cpe string and listed in the CVE references.

The CVSS score of 5.3 indicates a moderate severity. No EPSS score is available, but the description notes that the exploit is publicly available and that a remote attacker can initiate it. The vulnerability is not currently listed in the CISA KEV catalog. Attackers would likely transmit crafted requests to the changepassemp.php endpoint over the network in order to achieve data disclosure or modification.