EUVD-2026-34024
GHSA-pqvj-h8m2-63h6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been found in SourceCodester Human Resource Management 1.0. Affected by this vulnerability is an unknown functionality of the file /detailview.php of the component Employee View Page. Such manipulation of the argument employeeid leads to improper control of resource identifiers. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
AnalysisAI
Insecure Direct Object Reference (IDOR) in SourceCodester Human Resource Management 1.0 allows authenticated remote attackers to read other employees' records by manipulating the employeeid parameter in /detailview.php. The vulnerability results in unauthorized disclosure of employee data across account boundaries, with no integrity or availability impact. A publicly available proof-of-concept exploit exists; no active exploitation has been confirmed by CISA KEV at time of analysis.
Technical ContextAI
The affected product is a PHP-based Human Resource Management web application developed by SourceCodester (CPE: cpe:2.3:a:sourcecodester:human_resource_management:*:*:*:*:*:*:*:*). The root cause is CWE-99 - Improper Control of Resource Identifiers - a subclass of the broader IDOR (Insecure Direct Object Reference) weakness. The /detailview.php endpoint on the Employee View Page accepts a user-supplied employeeid parameter and uses it directly to retrieve employee records without verifying that the requesting user is authorized to view the specified resource. Because the identifier is predictable (likely a sequential integer), an authenticated user can iterate or directly specify arbitrary employee IDs to enumerate records they should not have access to. This is a well-understood PHP application pattern failure: missing object-level authorization check on a database-driven lookup.
RemediationAI
No vendor-released patch has been identified at time of analysis - the CPE wildcard and absence of a versioned fix in any reference confirm this. As the primary mitigation, implement server-side authorization checks in /detailview.php that verify the authenticated session's user identity against the requested employeeid before returning data; this is the correct architectural fix. As a compensating control, restrict access to the Employee View Page (/detailview.php) to HR administrators only at the application or web server level (e.g., Apache .htaccess or nginx auth_request), preventing general low-privilege users from reaching the endpoint entirely - note this may break legitimate multi-role workflows. Additionally, implement audit logging on employeeid parameter access to detect enumeration attempts. Organizations should evaluate whether this open-source application is appropriate for production use with sensitive employee data given its track record of similar vulnerabilities on VulDB. References: https://vuldb.com/vuln/367929, https://r4sh7n.medium.com/insecure-direct-object-reference-idor-vulnerability-in-employee-management-functionality-70df8ac5b1d3
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today