CVE-2026-90789
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A weakness has been identified in itsourcecode Leave Management System 1.0. Affected is some unknown functionality of the file /login.php. Manipulation of the user_email argument can lead to SQL injection. The attack may be launched remotely, and the exploit has been made available to the public.
Risk Assessment
An attacker can remotely perform SQL injection, potentially leading to unauthorized data access or modification.
Recommendation
Apply patches or mitigations for itsourcecode Leave Management System 1.0 as the exploit is publicly available; consider restricting access to /login.php.
Other vulnerabilities in itsourcecode Leave Management System
See all- CVE-2026-92526Medium
A flaw has been found in itsourcecode Leave Management System 1.0 affecting an unknown function of the file /module/leave/index.php. Manipulation of the ID argument leads to SQL injection. The attack may be launched remotely, and the exploit has been published and may be used.
- CVE-2026-92364Medium
A vulnerability has been found in itsourcecode Leave Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /module/employee/index.php. The manipulation of the argument ID leads to SQL injection, and the attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Original NVD description (English source)
A weakness has been identified in itsourcecode Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /login.php. Executing a manipulation of the argument user_email can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.