CVE-2026-9418

MediumCVSS 4.3/10Last modified Jul 23, 2026

Description

A flaw has been found in code-projects Employee Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /changepassemp.php. Executing a manipulation of the argument ID can lead to cross site scripting. The attack may be performed from remote. The exploit has been published and may be used.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

No affected versions have been published.

Timeline

Published: May 25, 2026
Last modified: Jul 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-941804.3Authorization Bypass Through User-Controlled Key vulnerability in Monetizemore Advanced Ads allows Retrieve Embedded Sensitive Data. This i CVE-2026-941817.4An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a <select> element th CVE-2026-941837.4Arc Search for Android before version 1.12.10 does not display a fullscreen notification when a page enters fullscreen mode while the app is CVE-2026-941845.3A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising N CVE-2026-941855.5nvm resolves a requested version or alias by treating it as a filename under $NVM_DIR/alias. Before 0.40.8, nvm_alias() concatenated the req CVE-2026-94194.3A vulnerability has been found in code-projects Employee Management System 1.0. Affected by this issue is some unknown functionality of the CVE-2026-941928.5A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask for that memory back CVE-2026-941946.3Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint mint allows a malicious HTTP/1 CVE-2026-941977.5An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the `Ex CVE-2026-94206.3A vulnerability was found in KLiK SocialMediaWebsite 1.0. This affects an unknown part of the component HTTP GET Request Parameter Handler. CVE-2026-942008.2Improper Validation of Consistency within Input vulnerability in Erlang OTP ssl (tls_handshake_1_3, ssl_handshake and tls_client_ticket_stor CVE-2026-942018.2Ash stores :atom-typed attributes as strings and compares them as strings. When such an attribute is referenced in a filter, the comparison