CVE-2026-82622: code-projects Employee Leave Managing System Employee Profile Update editaction.php cross site scripting
A security vulnerability has been detected in code-projects Employee Leave Managing System 1.0. Affected is an unknown function of the file /EmpManageSys/editaction.php of the component Employee Profile Update. The manipulation of the argument Name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
Affected Software
Event History
Frequently Asked Questions
What access and user interaction are required to exploit this issue?
The vulnerability is remotely reachable, but exploitation requires low-privileged access and user interaction. The available data does not specify the exact account role or the type of interaction required.
Which input and application function should defenders prioritize for investigation?
Prioritize the Employee Profile Update component, specifically /EmpManageSys/editaction.php and its Name argument. Review whether user-supplied Name values are stored or rendered without appropriate output encoding.
Is there evidence that exploitation is practical?
Yes. A public exploit has been disclosed, which may make exploitation more likely where the affected application is exposed to attackers with the required privileges.