Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.0
CVE-2026-102912: SourceCodester Leave Management System can be hacked via report page
CVE-2026-102912 · published 19 days ago
Summary
The online leave management system's report page lets an attacker supply malicious start or end dates that are sent directly to the database. This could allow a remote user to view, change or delete data stored in the system. Apply any available vendor updates, limit access to the admin area, and ensure input is properly checked to stop this behavior.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| sourcecodester | online leave management system | 1.0 |
Original advisory text
SourceCodester Online Leave Management System page reports sql injection
A vulnerability was identified in SourceCodester Online Leave Management System 1.0. This issue affects some unknown processing of the file /admin/?page=reports. The manipulation of the argument date_start/date_end leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-74Injection
CWE-89SQL Injection
Timeline
Published30 Sep 2026
Updated19 Oct 2026
First seen30 Sep 2026
Track software like this
Free during beta