CVE-2026-125074: SourceCodester Smart Attendance System with QR Code Scanner Password Reset reset_password.php password recovery
A flaw has been found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown function of the file resetpassword.php of the component Password Reset. This manipulation of the argument username/password causes weak password recovery. The attack is possible to be carried out remotely. The exploit has been published and may be used.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The issue can be exploited remotely and requires no privileges or user interaction. An exploit has been published, increasing the likelihood of attempted exploitation.
What component and inputs are involved?
The affected area is the Password Reset component, specifically reset_password.php. The reported weakness involves manipulation of the username and password arguments during password recovery.
How can I determine whether my deployment is affected?
The report identifies SourceCodester Smart Attendance System with QR Code Scanner version 1.0. Review whether that version is deployed and whether its reset_password.php password-recovery functionality is exposed.