CVE-2026-5210

HighCVSS 7.3

Published: 31/03/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

21th percentile - higher than 21% of all known CVEs

Summary

SourceCodester Leave Application System 1.0 has a file inclusion vulnerability via manipulation of the page argument. A remote attacker can exploit this without authentication. The exploit has been made public.

Risk Assessment

An attacker can include arbitrary files from the server, potentially leading to disclosure of sensitive data or server-side code execution.

Recommendation

Immediately disable SourceCodester Leave Application System until patches are released or apply appropriate security measures such as input validation.

Other vulnerabilities in SourceCodester Leave Application System

CVE-2026-5209Low
A cross-site scripting vulnerability was found in SourceCodester Leave Application System 1.0 in the User Management Handler component. Remote attack is possible. Exploit is publicly available.

Original NVD description (English source)

A vulnerability was detected in SourceCodester Leave Application System 1.0. This affects an unknown part. Performing a manipulation of the argument page results in file inclusion. Remote exploitation of the attack is possible. The exploit is now public and may be used.