CVE-2026-125076: SourceCodester Smart Attendance System with QR Code Scanner JSON Endpoint attendance_handler.php missing authentication
A vulnerability was found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. Affected is an unknown function of the file api/attendancehandler.php of the component JSON Endpoint. Performing a manipulation of the argument studentcode results in missing authentication. It is possible to initiate the attack remotely. The exploit has been made public and could be used.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The issue can be exploited remotely without authentication or user interaction. An attacker needs to be able to reach the application's api/attendance_handler.php endpoint.
What input is involved in exploitation?
The reported weakness is triggered by manipulating the student_code argument sent to the JSON endpoint. The affected function within attendance_handler.php is not identified.
Is exploit code available?
Yes. A public proof of concept is reported, which increases the likelihood of attempted exploitation.