Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-95833: itsourcecode Leave Management System can expose data via index.php
CVE-2026-95833 · published 26 days ago
Summary
The Leave Management System’s index page accepts a request parameter that can be manipulated to run unauthorized database commands. An attacker could remotely extract or alter employee leave records. Apply the vendor’s security patch or update to a newer version as soon as possible.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| itsourcecode | leave management system | 1.0 |
Original advisory text
itsourcecode Leave Management System index.php sql injection
A weakness has been identified in itsourcecode Leave Management System 1.0. Impacted is an unknown function of the file /module/leavetype/index.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-74Injection
CWE-89SQL Injection
Timeline
Published23 Sep 2026
Updated19 Oct 2026
First seen23 Sep 2026
Track software like this
Free during beta