Description
A weakness has been identified in itsourcecode Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /login.php. Executing a manipulation of the argument user_email can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
Published: 2026-09-14
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Data Compromise
Action: Immediate Patch
AI Analysis

Impact

A type of SQL injection flaw exists in the login.php page of itsourcecode Leave Management System 1.0. The flaw permits an attacker to inject arbitrary SQL statements via the user_email field before authentication. Injected SQL commands could retrieve, modify, or delete sensitive database contents, effectively compromising the confidentiality and integrity of user and company data. The weakness is caused by inadequate input validation and the construction of dynamic SQL queries, related to CWE-74 and CWE-89.

Affected Systems

The vulnerability affects the Leave Management System from itsourcecode, specifically version 1.0. No other versions have been identified as affected by this CVE.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate severity with an attack vector that is remote and user interaction not required. EPSS data is unavailable, and the vulnerability is not listed in CISA's KEV catalog, suggesting that widespread exploitation has not yet been reported. However, the issue has a publicly available exploit, so an attacker could potentially launch a remote attack over the web by crafting a malformed user_email payload directed at the login.php endpoint.

Generated by OpenCVE AI on September 15, 2026 at 13:40 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor-released patch that fixes the login.php SQL injection flaw.
  • If a patch is not yet available, restrict web access to login.php to trusted IP addresses or network segments.
  • Configure a Web Application Firewall or intrusion detection system to detect and block SQL injection patterns sent to the login.php page.

Generated by OpenCVE AI on September 15, 2026 at 13:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 14 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 14 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in itsourcecode Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /login.php. Executing a manipulation of the argument user_email can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
Title itsourcecode Leave Management System login.php sql injection
First Time appeared Itsourcecode
Itsourcecode leave Management System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:leave_management_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode leave Management System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode Leave Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-14T14:48:45.297Z

Reserved: 2026-09-13T13:17:49.109Z

Link: CVE-2026-90789

cve-icon Vulnrichment

Updated: 2026-09-14T14:48:41.071Z

cve-icon NVD

Status : Deferred

Published: 2026-09-14T15:17:12.967

Modified: 2026-09-14T20:56:48.220

Link: CVE-2026-90789

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-15T13:45:07Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')