{"id":"CVE-2026-76764","state":"PUBLISHED","title":"code-projects Employee Management System Admin Login Endpoint aprocess.php sql injection","description":"A flaw has been found in code-projects Employee Management System 1.0. The impacted element is an unknown function of the file /process/aprocess.php of the component Admin Login Endpoint. This manipulation of the argument mailuid causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.","publishedAt":"2026-08-20T00:00:13.051Z","updatedAt":"2026-08-21T16:10:48.257Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["code-projects Employee Management System"],"affected":[{"vendor":"code-projects","product":"Employee Management System","versions":[{"version":"1.0","status":"affected"}],"cpes":["cpe:2.3:a:code-projects:employee_management_system:*:*:*:*:*:*:*:*"],"modules":["Admin Login Endpoint"]}],"references":["https://vuldb.com/vuln/393236","https://vuldb.com/vuln/393236/cti","https://vuldb.com/cve/CVE-2026-76764","https://vuldb.com/submit/879173","https://github.com/niaoniaollll/cve/issues/10","https://code-projects.org/"],"weaknesses":["CWE-89","CWE-74"],"ingestedAt":"2026-10-29T20:12:58.252Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/76xxx/CVE-2026-76764.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-76764","state":"PUBLISHED","datePublished":"2026-08-20T00:00:13.051Z","dateUpdated":"2026-08-21T16:10:48.257Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-08-19T16:58:31.057Z"},"containers":{"cna":{"title":"code-projects Employee Management System Admin Login Endpoint aprocess.php sql injection","descriptions":[{"lang":"en","value":"A flaw has been found in code-projects Employee Management System 1.0. The impacted element is an unknown function of the file /process/aprocess.php of the component Admin Login Endpoint. This manipulation of the argument mailuid causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used."}],"affected":[{"vendor":"code-projects","product":"Employee Management System","versions":[{"version":"1.0","status":"affected"}],"cpes":["cpe:2.3:a:code-projects:employee_management_system:*:*:*:*:*:*:*:*"],"modules":["Admin Login Endpoint"]}],"references":[{"url":"https://vuldb.com/vuln/393236","name":"VDB-393236 | code-projects Employee Management System Admin Login Endpoint aprocess.php sql injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/393236/cti","name":"VDB-393236 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-76764","name":"CVE-2026-76764 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/879173","name":"Submit #879173 | code-projects EMPLOYEE MANAGEMENT SYSTEM v1.0 SQL injection","tags":["third-party-advisory"]},{"url":"https://github.com/niaoniaollll/cve/issues/10","tags":["exploit","issue-tracking"]},{"url":"https://code-projects.org/","tags":["product"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":7.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"HIGH"}},{"cvssV3_0":{"version":"3.0","baseScore":7.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"HIGH"}},{"cvssV2_0":{"version":"2.0","baseScore":7.5,"vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","type":"CWE","lang":"en","description":"SQL Injection"}]},{"descriptions":[{"cweId":"CWE-74","type":"CWE","lang":"en","description":"Injection"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-08-20T00:00:13.051Z"},"timeline":[{"time":"2026-08-19T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-08-19T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-08-19T19:03:37.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"niaoniaolll (VulDB User)","type":"reporter"}],"tags":["x_freeware"],"x_generator":["VulDB PVTS v202608"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-21T16:10:30.956801Z","id":"CVE-2026-76764","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-21T16:10:48.257Z"}}]}}}