CVE-2026-5209
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A cross-site scripting vulnerability was found in SourceCodester Leave Application System 1.0 in the User Management Handler component. Remote attack is possible. Exploit is publicly available.
Risk Assessment
An attacker can inject malicious scripts, leading to data theft or session hijacking.
Recommendation
Update the system to the latest version or apply a patch that prevents XSS.
Other vulnerabilities in SourceCodester Leave Application System
See all- CVE-2026-5326Medium
A vulnerability was identified in SourceCodester Leave Application System 1.0 in an unknown function of /index.php?page=manage_user within the User Information Handler component. Manipulation of the ID argument leads to authorization bypass, and the attack can be executed remotely. The exploit is publicly available and might be used.
- CVE-2026-5210High
SourceCodester Leave Application System 1.0 has a file inclusion vulnerability via manipulation of the page argument. A remote attacker can exploit this without authentication. The exploit has been made public.
Original NVD description (English source)
A security vulnerability has been detected in SourceCodester Leave Application System 1.0. Affected by this issue is some unknown functionality of the component User Management Handler. Such manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS