This vulnerability in code-projects Employee Management System 1.0 involves improper input handling in the /changepassemp.php file. Specifically, the ID parameter can be manipulated to inject malicious scripts, resulting in a cross-site scripting (XSS) condition. The vulnerability is remotely exploitable without privileges and does not require user authentication, but it does require user interaction to trigger the XSS payload. The CVSS 4.0 base score is 5.3, indicating medium severity. No official patch or vendor remediation level has been provided, and the product is not a cloud service.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary scripts in the context of a victim's browser session when interacting with the affected functionality. This can lead to theft of session tokens, defacement, or other malicious actions within the scope of the user's permissions. However, the impact is limited by the requirement for user interaction and the lack of privilege escalation or direct system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should apply standard XSS mitigations such as input validation and output encoding on the ID parameter in /changepassemp.php. Monitoring for suspicious activity related to this endpoint is advisable. No official remediation or temporary fix has been published by the vendor.