CVE-2026-9417

MediumCVSS 4.3/10Last modified Jul 23, 2026

Description

A vulnerability was detected in code-projects Employee Management System 1.0. Affected is an unknown function of the file /myprofileup.php. Performing a manipulation of the argument ID results in cross site scripting. The attack is possible to be carried out remotely. The exploit is now public and may be used.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

No affected versions have been published.

Timeline

Published: May 25, 2026
Last modified: Jul 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-941707.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Sassy Social Share sas CVE-2026-941717.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY woo-multi-currency al CVE-2026-941735.4Contributor Insecure Direct Object References (IDOR) in Business Directory <= 6.4.27 versions.CVE-2026-941747.6Administrator SQL Injection in Email Log <= 2.63 versions.CVE-2026-941767.1Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.1 versions.CVE-2026-941778.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allow CVE-2026-941787.5Subscriber Privilege Escalation in Import and export users and customers <= 2.5.2 versions.CVE-2026-941797.1Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 versions.CVE-2026-94184.3A flaw has been found in code-projects Employee Management System 1.0. Affected by this vulnerability is an unknown functionality of the fil CVE-2026-941804.3Authorization Bypass Through User-Controlled Key vulnerability in Monetizemore Advanced Ads allows Retrieve Embedded Sensitive Data. This i CVE-2026-941817.4An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a <select> element th CVE-2026-941837.4Arc Search for Android before version 1.12.10 does not display a fullscreen notification when a page enters fullscreen mode while the app is