CVE-2026-92364
MediumCVSS 6.3Summary
A vulnerability has been found in itsourcecode Leave Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /module/employee/index.php. The manipulation of the argument ID leads to SQL injection, and the attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Risk Assessment
A remote attacker could execute arbitrary SQL queries, potentially leading to data leakage, modification, or deletion from the database.
Recommendation
Immediately update or patch Leave Management System; if not possible, restrict access to the application and implement input validation.
Other vulnerabilities in itsourcecode Leave Management System
See all- CVE-2026-92526Medium
A flaw has been found in itsourcecode Leave Management System 1.0 affecting an unknown function of the file /module/leave/index.php. Manipulation of the ID argument leads to SQL injection. The attack may be launched remotely, and the exploit has been published and may be used.
- CVE-2026-90789High
A weakness has been identified in itsourcecode Leave Management System 1.0. Affected is some unknown functionality of the file /login.php. Manipulation of the user_email argument can lead to SQL injection. The attack may be launched remotely, and the exploit has been made available to the public.
Original NVD description (English source)
A vulnerability has been found in itsourcecode Leave Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /module/employee/index.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.