CVE-2025-11433
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A cross-site scripting (XSS) vulnerability was discovered in itsourcecode Leave Management System 1.0 in the redirect function of /module/employee/controller.php?action=reset. Manipulating the ID argument allows remote attack execution. The exploit has been published and may be used.
Risk Assessment
An attacker can inject malicious scripts, potentially leading to user session theft or admin account takeover. The risk is high because the attack can be performed remotely.
Recommendation
Immediately update the system to the latest version or apply a patch that eliminates the vulnerability. Also, validate and sanitize input in the redirect function.
Other vulnerabilities in Leave Management System
See all- CVE-2026-103690Medium
A flaw has been found in itsourcecode Leave Management System 1.0. This vulnerability affects unknown code of the file /module/leave/controller.php. Executing a manipulation of the argument LEAVEID can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.
- CVE-2026-103543Medium
A vulnerability has been found in itsourcecode Leave Management System 1.0. An unknown function in /module/leavetype/controller.php allows manipulation of the LEAVTID argument leading to SQL injection. The attack can be launched remotely and the exploit has been publicly disclosed.
- CVE-2026-95833Medium
SQL Injection vulnerability in Leave Management System 1.0. Affects unknown function in /module/leavetype/index.php. Manipulation of ID argument allows remote SQL injection. Exploit public.
- CVE-2026-94032Medium
A flaw was found in itsourcecode Leave Management System 1.0 in an unknown part of the file /module/department/index.php. Manipulation of the argument ID causes SQL injection. The attack can be initiated remotely and the exploit has been published.
- CVE-2026-93963Medium
A security vulnerability has been detected in itsourcecode Leave Management System 1.0 affecting an unknown function of the file /module/department/controller.php. Manipulation of the DEPTID argument leads to SQL injection, and the attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
- CVE-2026-90796Medium
A SQL injection vulnerability was identified in itsourcecode Leave Management System 1.0 in an unknown function of the file /module/company/index.php. Manipulation of the ID argument allows remote attack. The exploit is publicly available and might be used.
- CVE-2026-9542Medium
A flaw was found in Leave Management System 1.0 in the file /admin/add_staff.php. Manipulation of the email_id argument leads to SQL injection. The attack can be launched remotely, and the exploit is publicly available.
Original NVD description (English source)
A security flaw has been discovered in itsourcecode Leave Management System 1.0. This impacts the function redirect of the file /module/employee/controller.php?action=reset of the component Query Parameter Handler. Performing a manipulation of the argument ID results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS