CVE-2026-108972
HighCVSS 7.3Exploitation Probability (EPSS)
Elevated risk50th percentile - higher than 50% of all known CVEs
Summary
A vulnerability was found in SourceCodester Human Resource Management System 1.0 in the session_start function of controller/employee.php in the Employee Endpoint component. Manipulation of role/pfimg/EmpId arguments leads to improper authentication. The attack can be launched remotely and the exploit is public.
Risk Assessment
The risk involves potential remote authentication bypass, which could allow unauthorized access to HR management functions and employee data.
Recommendation
It is recommended to apply vendor patches immediately and conduct a security audit to identify similar issues.
Other vulnerabilities in SourceCodester Human Resource Management System
Original NVD description (English source)
A vulnerability was found in SourceCodester Human Resource Management System 1.0. Affected by this vulnerability is the function session_start of the file controller/employee.php of the component Employee Endpoint. The manipulation of the argument role/pfimg/EmpId results in improper authentication. It is possible to launch the attack remotely. The exploit has been made public and could be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS