A flaw in the reset_password.php function of SourceCodester Smart Attendance System with QR Code Scanner allows an attacker to manipulate the username and password arguments, enabling an insecure password recovery path. The vulnerability permits remote exploitation, as documented by the published exploit, and can lead to unauthorized access to user accounts and system resources through incorrect authentication (CWE-640).

The affected product is SourceCodester Smart Attendance System with QR Code Scanner, version 1.0, deployed on web servers configured to expose the reset_password.php endpoint.

With a CVSS score of 6.9, this vulnerability presents moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, yet the published exploit indicates a realistic chance of use. Remote attackers can trigger the reset_password.php script directly, supply crafted username and password values, and obtain account access without valid credentials. The lack of robust authentication checks in the password reset flow increases the attack surface and facilitates unauthorized account takeover.