CVE-2026-9449

MediumCVSS 6.3/10Last modified Jul 23, 2026

Description

A vulnerability was identified in code-projects Employee Management System 1.0. This impacts an unknown function of the file /changepassemp.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-89

Affected software

No affected versions have been published.

Timeline

Published
May 25, 2026
Last modified
Jul 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-944917.3A weakness has been identified in Yonyou KSOA 9.0. This affects an unknown part of the file /cardcase/search_list.jsp. Executing a manipulatCVE-2026-944926.3A security vulnerability has been detected in Yonyou U8cloud 5.x. This vulnerability affects unknown code of the file /u8cloud/openapi/so.saCVE-2026-9449310.0A vulnerability was detected in Gigatech PDV5701 1.0.31_240305_112640. This issue affects some unknown processing of the file /index.html ofCVE-2026-944945.0jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users to read other tenants' records via the GCVE-2026-944957.1jshERP through 3.6 fails to properly validate user privileges in SystemConfigService.updateSystemConfig, allowing authenticated users to modCVE-2026-944968.3jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's dataCVE-2026-944978.3jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resource types. AuthenticaCVE-2026-944986.5Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions.CVE-2026-944997.1Subscriber Broken Access Control in FormGent <= 1.12.2 versions.CVE-2026-94506.3A security flaw has been discovered in code-projects Employee Management System 1.0. Affected is an unknown function of the file /psubmit.phCVE-2026-945006.5Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4.0.5 versions.CVE-2026-945018.8jshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoints that allows authenticated users to crea