Description
A vulnerability has been found in itsourcecode Leave Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /module/employee/index.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Published: 2026-09-16
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: SQL Injection via ID parameter in employee module
Action: Patch Now
AI Analysis

Impact

The vulnerability is a classic SQL injection located in the file /module/employee/index.php of itsourcecode Leave Management System 1.0. An attacker can manipulate the ID argument, allowing unfiltered user data to be injected into SQL statements. Because the application fails to validate or escape user input, CWE-74 and CWE-89 weaknesses are present. This flaw can lead to unauthorized data exposure or tampering, impacting the confidentiality and integrity of employee records.

Affected Systems

The affected product is itsourcecode Leave Management System version 1.0, specifically the employee module that processes the ID argument. The vulnerability is present in unknown functionality within that module and may affect any installation of the product that relies on the /module/employee/index.php script.

Risk and Exploitability

With a CVSS score of 5.3 this vulnerability is considered moderate, and the EPSS score of less than 1% indicates a very low known exploitation probability. The flaw is exploitable remotely, meaning an attacker does not need local access and can target the system over the network. The vulnerability is not currently listed in the CISA KEV catalog, but because the exploit has been publicly disclosed, the risk to organizations that operate this software remains significant.

Generated by OpenCVE AI on September 18, 2026 at 05:45 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to or apply the vendor patch that removes the SQL injection flaw in the employee module.
  • If no patch is available, refactor the code that handles the ID parameter to use parameterized queries or robust input validation, mitigating the SQL injection weakness.
  • Implement role‑based access control so that only authorized users can reach the employee module and the vulnerable endpoint.

Generated by OpenCVE AI on September 18, 2026 at 05:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 16 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 16 Sep 2026 14:00:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in itsourcecode Leave Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /module/employee/index.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Title itsourcecode Leave Management System index.php sql injection
First Time appeared Itsourcecode
Itsourcecode leave Management System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:leave_management_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode leave Management System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode Leave Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-16T15:28:07.175Z

Reserved: 2026-09-16T05:40:54.536Z

Link: CVE-2026-92364

cve-icon Vulnrichment

Updated: 2026-09-16T15:28:02.223Z

cve-icon NVD

Status : Deferred

Published: 2026-09-16T14:17:16.727

Modified: 2026-09-16T17:53:40.500

Link: CVE-2026-92364

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-18T06:00:04Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')