The code-projects Employee Management System version 1.0 contains an SQL injection vulnerability in the 370project/edit.php file. Specifically, the ID parameter is not properly sanitized, allowing an attacker to inject malicious SQL commands remotely. This vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity with network attack vector, low complexity, and no privileges or user interaction required. The vulnerability was publicly disclosed on 2026-04-27, but no official fix or patch has been provided by the vendor as of this publication.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access or modification within the Employee Management System. However, the impact is rated medium severity, and no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and parameterized queries as a temporary mitigation to prevent SQL injection via the ID parameter. Monitor vendor communications for updates on patches or official mitigations.