This vulnerability in code-projects Employee Management System 1.0 allows an attacker to perform cross-site scripting by manipulating the ID parameter in the /applyleave.php file. The CVSS 4.0 base score is 5.3, indicating a medium severity issue with network attack vector, low attack complexity, no privileges required, but user interaction needed. The vulnerability is publicly disclosed, but no official fix or patch has been published by the vendor. The product is not a cloud service, so remediation depends on vendor patch availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser when interacting with the vulnerable parameter. This may lead to session hijacking, defacement, or other client-side impacts. However, the vulnerability requires user interaction and does not grant direct system access or privilege escalation. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider applying input validation or output encoding on the ID parameter in /applyleave.php to mitigate XSS risks. Monitor vendor channels for updates and patches addressing this vulnerability.