Is there a public PoC exploit available for CVE-2026-5210?

Yes, a public proof-of-concept exploit is available for CVE-2026-5210. Prioritise patching immediately. EPSS: 0.0%.

Leave Application System CVE-2026-5210

Q: What is the CVSS score of CVE-2026-5210?

CVE-2026-5210 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17589 MEDIUM

External Control of File Name or Path (CWE-73)

2026-03-31 VulDB

Information Disclosure Leave Application System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 01, 2026 - 14:23 vuln.today

Public exploit code

EUVD ID Assigned

Mar 31, 2026 - 19:01 euvd

EUVD-2026-17589

Analysis Generated

Mar 31, 2026 - 19:01 vuln.today

CVE Published

Mar 31, 2026 - 18:30 nvd

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was detected in SourceCodester Leave Application System 1.0. This affects an unknown part. Performing a manipulation of the argument page results in file inclusion. Remote exploitation of the attack is possible. The exploit is now public and may be used.

AnalysisAI

Remote file inclusion in SourceCodester Leave Application System 1.0 allows unauthenticated attackers to manipulate the page parameter and access arbitrary files, resulting in information disclosure. The CVSS 4.0 score of 6.9 reflects low confidentiality impact with network-based attack vector and no user interaction required. Publicly available exploit code exists, increasing practical risk despite the moderate CVSS rating.

Technical ContextAI

The vulnerability stems from insufficient input validation on the 'page' parameter, classified under CWE-73 (External Control of File Name or Path). This weakness permits attackers to traverse the application's file system or include remote files through path manipulation, commonly achieved via directory traversal sequences (../, ..\) or protocol wrappers (php://, file://, http://). The affected product is SourceCodester Leave Application System running on PHP with SQLite3 backend, as evidenced by the exploit reference detailing LFI techniques specific to this stack. The vulnerability allows reading sensitive configuration files, source code, or other non-executable content accessible to the web server process.

RemediationAI

Upgrade SourceCodester Leave Application System to a patched version released by SourceCodester that addresses input validation on the page parameter. Until patched, implement strict input validation using whitelist-based path controls, rejecting any page parameter values containing path traversal sequences (../, ..\ backslash) or protocol wrappers. Deploy Web Application Firewall (WAF) rules to block common file inclusion attack patterns on the page parameter. Review access logs and system monitoring to detect exploitation attempts. Consult SourceCodester's official website (https://www.sourcecodester.com/) for patch availability and release notes. For vulnerability details and proof-of-concept context, reference the VulDB entries at https://vuldb.com/vuln/354346 and the technical writeup demonstrating LFI exploitation at https://medium.com/@hemantrajbhati5555/local-file-inclusion-lfi-in-leave-application-system-php-sqlite3-4e095bb7ee40.