This vulnerability involves an SQL injection in the Employee Management System 1.0 by code-projects. Specifically, the 'pid' parameter in the /psubmit.php file can be manipulated remotely to inject SQL commands. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed with an available exploit, but no vendor patch or fix has been identified.

Successful exploitation allows an attacker to execute arbitrary SQL commands on the backend database remotely via the 'pid' parameter. This could lead to unauthorized data access or modification depending on the database permissions. The impact is rated medium due to limited impact on confidentiality, integrity, and availability as per the CVSS vector. There are no confirmed exploitations in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing input validation or parameterized queries as a temporary mitigation to prevent SQL injection via the 'pid' parameter. Monitoring for unusual database queries related to this parameter may also help detect exploitation attempts.