CVE-2026-90789

itsourcecode Leave Management System login.php sql injection

View on CVE.org
Published Sep 14, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A weakness has been identified in itsourcecode Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /login.php. Executing a manipulation of the argument user_email can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

Analysis

AI-generated

Technical impact

A type of SQL injection flaw exists in the login.php page of itsourcecode Leave Management System 1.0. The flaw permits an attacker to inject arbitrary SQL statements via the user_email field before authentication. Injected SQL commands could retrieve, modify, or delete sensitive database contents, effectively compromising the confidentiality and integrity of user and company data. The weakness is caused by inadequate input validation and the construction of dynamic SQL queries, related to CWE-74 and CWE-89.

Affected Systems

The vulnerability affects the Leave Management System from itsourcecode, specifically version 1.0. No other versions have been identified as affected by this CVE.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate severity with an attack vector that is remote and user interaction not required. EPSS data is unavailable, and the vulnerability is not listed in CISA's KEV catalog, suggesting that widespread exploitation has not yet been reported. However, the issue has a publicly available exploit, so an attacker could potentially launch a remote attack over the web by crafting a malformed user_email payload directed at the login.php endpoint.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor-released patch that fixes the login.php SQL injection flaw.
  • If a patch is not yet available, restrict web access to login.php to trusted IP addresses or network segments.
  • Configure a Web Application Firewall or intrusion detection system to detect and block SQL injection patterns sent to the login.php page.

Generated by OpenCVE AI on September 15, 2026 at 13:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A weakness has been identified in itsourcecode Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /login.php. Executing a manipulation of the argument user_email can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
Title itsourcecode Leave Management System login.php sql injection
First Time appeared Itsourcecode
Itsourcecode leave Management System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:leave_management_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode leave Management System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 14, 2026, 2:48 PM
Reserved
Sep 13, 2026, 1:17 PM

View source JSON

Updated
Sep 14, 2026, 2:48 PM

JSON

Status
Deferred
Published
Sep 14, 2026, 3:17 PM
Modified
Sep 14, 2026, 8:56 PM

View source JSON

No data.

Updated
Sep 15, 2026, 1:45 PM

JSON