CVE-2026-92526: itsourcecode Leave Management System index.php sql injection
Published Sep 16, 2026
·Updated
A flaw has been found in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/leave/index.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.
Affected Software
1 affected component
itsourcecode Leave Management System=1.0
Event History
Sep 16, 2026
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The vulnerability requires low privileges. An attacker must be able to make remote requests and manipulate the ID argument handled by /module/leave/index.php.
2
What is the likely impact if exploitation succeeds?
Successful exploitation can result in SQL injection, with low assessed impact to confidentiality, integrity, and availability. A public exploit is available, which may make exploitation more practical.