CVE-2026-93963
MediumCVSS 6.3Summary
A security vulnerability has been detected in itsourcecode Leave Management System 1.0 affecting an unknown function of the file /module/department/controller.php. Manipulation of the DEPTID argument leads to SQL injection, and the attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
Risk Assessment
SQL injection may allow an attacker to read, modify, or delete database data, potentially resulting in information leakage and compromise of system integrity.
Recommendation
Patch the vulnerability as soon as possible by parameterizing SQL queries and validating the DEPTID argument, and consider restricting access to the department module.
Other vulnerabilities in Leave Management System
See all- CVE-2026-90796Medium
A SQL injection vulnerability was identified in itsourcecode Leave Management System 1.0 in an unknown function of the file /module/company/index.php. Manipulation of the ID argument allows remote attack. The exploit is publicly available and might be used.
- CVE-2026-9542Medium
A flaw was found in Leave Management System 1.0 in the file /admin/add_staff.php. Manipulation of the email_id argument leads to SQL injection. The attack can be launched remotely, and the exploit is publicly available.
Original NVD description (English source)
A security vulnerability has been detected in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/department/controller.php. The manipulation of the argument DEPTID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.