CVE-2026-102912: SourceCodester Online Leave Management System page reports sql injection
A vulnerability was identified in SourceCodester Online Leave Management System 1.0. This issue affects some unknown processing of the file /admin/?page=reports. The manipulation of the argument datestart/dateend leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vulnerable reports page is under /admin/, and the provided CVSS vector indicates high privileges are required. Exploitation is remote and does not require user interaction.
Which inputs should be treated as vulnerable?
The affected processing involves the date_start and date_end arguments on /admin/?page=reports. Manipulation of either argument can lead to SQL injection.
Is there public exploit activity to account for?
A public exploit is available and may be used. Prioritize review of internet-reachable deployments and access to the administrative reports page.