A SQL injection vulnerability (CVE-2026-76764) affects code-projects Employee Management System 1.0. The issue arises from improper handling of the mailuid argument in an unknown function of /process/aprocess.php at the Admin Login Endpoint, allowing an attacker to inject SQL commands remotely. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity) with network attack vector, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. An exploit has been published, but no known active exploitation is reported.

Successful exploitation allows remote attackers to perform SQL injection attacks via the mailuid parameter at the Admin Login Endpoint, potentially leading to unauthorized data access or manipulation. The impact is rated medium severity with limited confidentiality, integrity, and availability impact according to the CVSS vector.

No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable endpoint and consider implementing web application firewall rules to detect and block SQL injection attempts targeting the mailuid parameter.