Description
A weakness has been identified in itsourcecode Leave Management System 1.0. Impacted is an unknown function of the file /module/leavetype/index.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Published: 2026-09-22
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: SQL injection enabling unauthorized database access
Action: Apply Patch
AI Analysis

Impact

The Leave Management System version 1.0 contains an SQL injection flaw in module/leavetype/index.php where the ID parameter is not validated or escaped. An attacker can send a crafted request that manipulates the SQL query, potentially retrieving or modifying sensitive data. This weakness permits the compromise of confidentiality and integrity of employee information stored in the database.

Affected Systems

Itsourcecode’s Leave Management System 1.0 is affected, as identified by the vulnerability database. No additional versions are specified, so users of this or older releases should consider reassessment.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, yet the exploit is publicly available. The attack can be initiated remotely via HTTP requests, meaning that any system exposed to the internet is susceptible until mitigation steps are applied.

Generated by OpenCVE AI on September 23, 2026 at 01:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update to a patched version of the Leave Management System once the vendor releases the fix.
  • Modify the ID handling in /module/leavetype/index.php to use parameterized queries or proper escaping, addressing the SQL injection weakness.
  • Configure the database account used by the application with the least privileges necessary to limit the impact of a potential injection attack.

Generated by OpenCVE AI on September 23, 2026 at 01:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 23 Sep 2026 00:00:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in itsourcecode Leave Management System 1.0. Impacted is an unknown function of the file /module/leavetype/index.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Title itsourcecode Leave Management System index.php sql injection
First Time appeared Itsourcecode
Itsourcecode leave Management System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:leave_management_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode leave Management System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode Leave Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-22T23:45:11.958Z

Reserved: 2026-09-22T16:30:18.762Z

Link: CVE-2026-95833

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-23T00:17:01.743

Modified: 2026-09-23T00:17:01.743

Link: CVE-2026-95833

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T01:30:17Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')