CVE-2026-9450

MediumCVSS 6.3/10Last modified Jul 23, 2026

Description

A security flaw has been discovered in code-projects Employee Management System 1.0. Affected is an unknown function of the file /psubmit.php. The manipulation of the argument pid results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-89

Affected software

No affected versions have been published.

Timeline

Published
May 25, 2026
Last modified
Jul 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-945006.5Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4.0.5 versions.CVE-2026-945018.8jshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoints that allows authenticated users to creaCVE-2026-945027.5In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write potentially leading to remote CVE-2026-9450310.0Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issueCVE-2026-945047.2Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An CVE-2026-945058.1The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versionCVE-2026-945066.5Out-of-bounds read in Microsoft Office Access allows an unauthorized attacker to disclose information over a network.CVE-2026-94516.3A weakness has been identified in code-projects Employee Management System 1.0. Affected by this vulnerability is an unknown functionality oCVE-2026-945109.9Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network.CVE-2026-945128.8Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.CVE-2026-94527.3A security vulnerability has been detected in FoundDream miniclawd up to 2d65665046e2222eeea76cafc8570ed546a8c125. Affected by this issue isCVE-2026-945204.9Use of externally-controlled format string in SQL Server allows an authorized attacker to deny service over a network.