CVE-2026-92526
MediumCVSS 6.3Summary
A flaw has been found in itsourcecode Leave Management System 1.0 affecting an unknown function of the file /module/leave/index.php. Manipulation of the ID argument leads to SQL injection. The attack may be launched remotely, and the exploit has been published and may be used.
Risk Assessment
An attacker could remotely perform SQL injection, potentially leading to unauthorized database access, modification, or data leakage. Because the exploit is publicly available, the risk of exploitation is high.
Recommendation
Update or patch Leave Management System as soon as possible; if not possible, restrict access to the application and implement input filtering. Also review logs for exploitation attempts.
Other vulnerabilities in itsourcecode Leave Management System
See all- CVE-2026-92364Medium
A vulnerability has been found in itsourcecode Leave Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /module/employee/index.php. The manipulation of the argument ID leads to SQL injection, and the attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- CVE-2026-90789High
A weakness has been identified in itsourcecode Leave Management System 1.0. Affected is some unknown functionality of the file /login.php. Manipulation of the user_email argument can lead to SQL injection. The attack may be launched remotely, and the exploit has been made available to the public.
Original NVD description (English source)
A flaw has been found in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/leave/index.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.