Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.1

itsourcecode Employee Management System 1.0: SQL Injection Risk in Admin Login

CVE-2025-8172 · published 1 year ago
Summary

A security weakness in the itsourcecode Employee Management System 1.0 can allow an attacker to manipulate user data, potentially gaining unauthorized access to sensitive information. This issue affects the admin login functionality, making it possible for attackers to exploit it remotely. We recommend that you update the system to the latest version or apply the provided patch to mitigate this risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
clivedelacruz employee_management_system 1.0
cpe:2.3:a:clivedelacruz:employee_management_system:1.0:*:*:*:*:*:*:*
Original advisory text
A vulnerability, which was classified as critical, was found in itsourcecode Employee Management System 1.0. Affected is an unknown function of the file /admin/index.php. The manipulation of the ar...
A vulnerability, which was classified as critical, was found in itsourcecode Employee Management System 1.0. Affected is an unknown function of the file /admin/index.php. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
2.1 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-74Injection
CWE-89SQL Injection
Timeline
Published25 Jul 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-8172 · NVD
Track software like this
Free during beta