Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-103543: itsourcecode Leave Management System remote SQL injection
CVE-2026-103543 · published 18 days ago
Summary
The Leave Management System version 1.0 allows an attacker to send specially crafted data to the LEAVTID field in the controller.php file, causing the system to run unauthorized database commands. This can be done from anywhere on the internet and could let an attacker view, change, or delete employee leave records. Apply the vendor's security patch or update to a newer version as soon as possible.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| itsourcecode | leave management system | 1.0 |
Original advisory text
itsourcecode Leave Management System controller.php sql injection
A vulnerability has been found in itsourcecode Leave Management System 1.0. The affected element is an unknown function of the file /module/leavetype/controller.php. Such manipulation of the argument LEAVTID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-74Injection
CWE-89SQL Injection
Timeline
Published1 Oct 2026
Updated14 Oct 2026
First seen1 Oct 2026
Track software like this
Free during beta