HR Management CVE-2026-10624

The attacker must hold a valid, authenticated session with at least low-level privileges in the SourceCodester Human Resource Management 1.0 application - PR:L in the CVSS 4.0 vector confirms this. The vulnerable endpoint /detailview.php must be network-accessible (AV:N). No additional attack requirements (AT:N) or user interaction (UI:N) are needed beyond authentication. What limits exploitation: a valid application account is required (unauthenticated external attackers cannot exploit this directly); the impact is read-only (VC:L, VI:N) - data exfiltration of employee records, not account takeover or system compromise; and scope is contained to the vulnerable component (SC:N, SI:N, SA:N). Organizations where all application users are fully trusted (e.g., internal-only HR tools with no untrusted employee self-service access) face substantially reduced risk.

The CVSS 4.0 base score of 2.1 (Vector: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) reflects a narrow, low-severity impact: network-exploitable, low-complexity, requiring low-level authentication, with only limited confidentiality impact and zero integrity or availability impact. The E:P supplemental metric confirms a proof-of-concept is publicly available, which elevates the practical ease of exploitation above what the base score alone implies. However, the vulnerability is not listed in CISA KEV, and no EPSS data was provided in the input - opportunistic mass exploitation appears unlikely given that low-privilege authentication is required. The real-world risk is primarily insider threat or compromised low-privilege account scenarios in organizations running this specific open-source application. SourceCodester applications are typically deployed in academic, small-business, and hobbyist contexts; organizations running this in production with sensitive employee PII face the highest exposure. CVSS correctly signals this as low severity, and the POC existence does not meaningfully change that assessment given the authentication prerequisite.

An attacker with any valid low-privilege account (e.g., a standard employee login) authenticates to the HR Management application and navigates to /detailview.php?employeeid=1, then iterates the employeeid value sequentially to retrieve the profile data of all other employees in the system. The publicly available proof-of-concept on Medium documents this exact technique, making it trivially reproducible by any authenticated user without specialized tooling.