CVE-2026-90796
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A SQL injection vulnerability was identified in itsourcecode Leave Management System 1.0 in an unknown function of the file /module/company/index.php. Manipulation of the ID argument allows remote attack. The exploit is publicly available and might be used.
Risk Assessment
An attacker can remotely manipulate SQL queries, potentially leading to unauthorized data access, modification, or deletion. The publicly available exploit increases the risk of rapid exploitation.
Recommendation
It is recommended to immediately apply patches or updates to the Leave Management System. Also, validate and secure input parameters in /module/company/index.php against SQL injection.
Other vulnerabilities in Leave Management System
See all- CVE-2026-93963Medium
A security vulnerability has been detected in itsourcecode Leave Management System 1.0 affecting an unknown function of the file /module/department/controller.php. Manipulation of the DEPTID argument leads to SQL injection, and the attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
- CVE-2026-9542Medium
A flaw was found in Leave Management System 1.0 in the file /admin/add_staff.php. Manipulation of the email_id argument leads to SQL injection. The attack can be launched remotely, and the exploit is publicly available.
Original NVD description (English source)
A vulnerability was identified in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/company/index.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.