Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-103690: itsourcecode Leave Management System remote SQL injection risk
CVE-2026-103690 · published 17 days ago
Summary
The Leave Management System version 1.0 lets an attacker send a specially crafted request to the leave controller page and cause the underlying database to run unintended commands. This can be done over the internet and could let someone view, change or delete your employee leave records. Apply any available updates from the vendor and make sure input fields are properly checked or filtered to stop such attacks.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| itsourcecode | leave management system | 1.0 |
Original advisory text
itsourcecode Leave Management System controller.php sql injection
A flaw has been found in itsourcecode Leave Management System 1.0. This vulnerability affects unknown code of the file /module/leave/controller.php. Executing a manipulation of the argument LEAVEID can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-74Injection
CWE-89SQL Injection
Timeline
Published1 Oct 2026
Updated15 Oct 2026
First seen1 Oct 2026
Track software like this
Free during beta