CVE-2026-105776: bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL admin_transaction.php sql injection
A flaw has been found in bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL up to ae783195ba7e0390d3b3bfaddd99944b7e9735a4. Affected by this vulnerability is an unknown functionality of the file /admintransaction.php. This manipulation of the argument Username causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The issue can be exploited remotely and requires no privileges or user interaction. An attacker can target the Username argument handled by /admin_transaction.php.
Is exploit code available?
Yes. The available data states that an exploit has been published, increasing the likelihood of attempted exploitation.
Are fixed versions available?
No affected or fixed release versions are identified because the project uses a rolling release model. The project was notified through an issue report but had not responded at the time of publication.
How can I determine whether my deployment is affected?
Deployments containing /admin_transaction.php that process the Username argument are implicated by the report, for source states up to commit ae783195ba7e0390d3b3bfaddd99944b7e9735a4. No vendor-provided fixed-version boundary is available.