A security vulnerability has been detected in code-projects Employee Leave Managing System 1.0. (CVE-2026-82622)

CVE-2026-82622 is a cross-site scripting vulnerability in code-projects Employee Leave Managing System 1.0. The flaw resides in an unspecified function in the /EmpManageSys/editaction.php file related to the Employee Profile Update component. Manipulating the 'Name' parameter can lead to XSS, enabling remote attackers to execute scripts in the context of the affected application. The vulnerability has a CVSS 3.1 base score of 3.5 (low severity) with network attack vector, low attack complexity, requiring low privileges and user interaction. Public exploit disclosure exists, but no active exploitation is known.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to limited impact such as user interface manipulation or session hijacking. The vulnerability does not affect confidentiality or availability according to the CVSS vector, indicating no direct data disclosure or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider applying input validation or output encoding on the 'Name' parameter to mitigate XSS risks. Monitor official vendor channels for updates.