The vulnerability resides in the /psubmit.php file of the code‑projects Employee Management System 1.0. Manipulating the pid argument allows an attacker to inject arbitrary SQL code. This flaw can be exploited remotely, enabling unauthorized data extraction or modification. The impact is a compromise of confidentiality and integrity of the underlying database, and could allow further lateral movement if the database contains other sensitive information.

Affected product: code‑projects Employee Management System version 1.0. The specific vulnerable code is the unknown function in /psubmit.php which processes the pid parameter. Any installation using this version and exposing the web interface is potentially susceptible.

The CVSS score of 5.3 indicates a medium severity scenario. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited widespread exploitation. However, public exploit code has been released, and attackers can target the system remotely by sending crafted requests to the /psubmit.php endpoint. The risk remains medium, with potential for data compromise if the vulnerability is present and the web service is publicly reachable.