CVE-2026-82622: Cross Site Scripting in code-projects Employee Leave Managing System

This vulnerability in code-projects Employee Leave Managing System 1.0 involves improper sanitization of the Name parameter in the /EmpManageSys/editaction.php file within the Employee Profile Update component. An attacker can remotely exploit this flaw by injecting malicious scripts via the Name argument, leading to cross-site scripting. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity. Public exploit details have been disclosed, but no vendor-provided fix or patch is currently documented.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other client-side impacts. The vulnerability requires low attack complexity and no privileges but does require user interaction. There is no indication of elevated privileges or direct system compromise from this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or sanitization controls on the Name parameter and limit exposure by restricting access to the affected component where feasible.