CVE-2026-103543: itsourcecode Leave Management System controller.php sql injection
Published Oct 1, 2026
·Updated
A vulnerability has been found in itsourcecode Leave Management System 1.0. The affected element is an unknown function of the file /module/leavetype/controller.php. Such manipulation of the argument LEAVTID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Affected Software
1 affected component
itsourcecode Leave Management System=1.0
Event History
Oct 1, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The attack can be launched remotely, but the CVSS vector indicates that low privileges are required. No user interaction is required.
2
Which deployments are affected?
The affected product is itsourcecode Leave Management System version 1.0. The vulnerable input is the LEAVTID argument handled by /module/leavetype/controller.php.
3
Is exploit code available?
Yes. The exploit has been publicly disclosed and may be used.