This vulnerability affects code-projects Employee Management System 1.0 and involves SQL injection via the ID parameter in the /process/applyleaveprocess.php file. The weakness allows an attacker with low privileges to remotely manipulate SQL queries, potentially impacting the confidentiality, integrity, and availability of the system's data. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no user interaction, and low impact on confidentiality, integrity, and availability. No official fix or patch has been disclosed, and the product is not a cloud service, so remediation depends on vendor action or user mitigation.

Successful exploitation could allow an attacker to execute unauthorized SQL commands remotely, potentially leading to unauthorized data access or modification. The impact on confidentiality, integrity, and availability is rated as low. The vulnerability requires low privileges and no user interaction, increasing the risk of exploitation. However, no known active exploitation has been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should consider implementing input validation and parameterized queries as temporary mitigations to prevent SQL injection. Monitoring for unusual database activity may also help detect exploitation attempts. Stay updated with vendor communications for any forthcoming patches.