CVE-2026-94032
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A flaw was found in itsourcecode Leave Management System 1.0 in an unknown part of the file /module/department/index.php. Manipulation of the argument ID causes SQL injection. The attack can be initiated remotely and the exploit has been published.
Risk Assessment
A remote attacker could execute arbitrary SQL queries, potentially leading to data leakage, modification, or deletion. The public availability of the exploit increases the risk of rapid exploitation.
Recommendation
Update itsourcecode Leave Management System to a patched version or implement input validation for parameters. Until then, restrict access to the administrative panel.
Other vulnerabilities in Leave Management System
See all- CVE-2026-95833Medium
SQL Injection vulnerability in Leave Management System 1.0. Affects unknown function in /module/leavetype/index.php. Manipulation of ID argument allows remote SQL injection. Exploit public.
- CVE-2026-93963Medium
A security vulnerability has been detected in itsourcecode Leave Management System 1.0 affecting an unknown function of the file /module/department/controller.php. Manipulation of the DEPTID argument leads to SQL injection, and the attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
- CVE-2026-90796Medium
A SQL injection vulnerability was identified in itsourcecode Leave Management System 1.0 in an unknown function of the file /module/company/index.php. Manipulation of the ID argument allows remote attack. The exploit is publicly available and might be used.
- CVE-2026-9542Medium
A flaw was found in Leave Management System 1.0 in the file /admin/add_staff.php. Manipulation of the email_id argument leads to SQL injection. The attack can be launched remotely, and the exploit is publicly available.
Original NVD description (English source)
A flaw has been found in itsourcecode Leave Management System 1.0. This affects an unknown part of the file /module/department/index.php. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS