CVE-2026-9419

MediumCVSS 4.3/10Last modified Jul 23, 2026

Description

A vulnerability has been found in code-projects Employee Management System 1.0. Affected by this issue is some unknown functionality of the file /empproject.php. The manipulation of the argument ID leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

No affected versions have been published.

Timeline

Published: May 25, 2026
Last modified: Jul 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-941928.5A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask for that memory back CVE-2026-941946.3Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint mint allows a malicious HTTP/1 CVE-2026-941977.5An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the `Ex CVE-2026-94206.3A vulnerability was found in KLiK SocialMediaWebsite 1.0. This affects an unknown part of the component HTTP GET Request Parameter Handler. CVE-2026-942008.2Improper Validation of Consistency within Input vulnerability in Erlang OTP ssl (tls_handshake_1_3, ssl_handshake and tls_client_ticket_stor CVE-2026-942018.2Ash stores :atom-typed attributes as strings and compares them as strings. When such an attribute is referenced in a filter, the comparison CVE-2026-942024.8The Module Manager's block-pool create dispatcher proved that two `ALIGN_TYPE` words of the extra-parameter array a memory-protected module CVE-2026-942047.5The central cloud storage backend for the entire dashcam platform is misconfigured with public-read permissions, allowing unrestricted acces CVE-2026-942059.8Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request CVE-2026-942066.3Use of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloak_ecto and danielberkompas cloak allows an CVE-2026-94217.3A vulnerability was determined in KLiK SocialMediaWebsite 1.0. This vulnerability affects the function uniqid of the file upload.inc.php of CVE-2026-942103.5A flaw has been found in Hyve5 Leantime up to 3.9.8. Affected by this vulnerability is the function getAllGrouped of the file app/Domain/Tic