Is there a public PoC exploit available for CVE-2026-92526?

Yes, a public proof-of-concept exploit is available for CVE-2026-92526. Prioritise patching immediately.

Leave Management System CVE-2026-92526

Q: What is the CVSS score of CVE-2026-92526?

CVE-2026-92526 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

EUVD-2026-81092 LOW

SQL Injection (CWE-89)

2026-09-16 VulDB

GHSA-p73f-42xj-hp2g

PHP SQLi Leave Management System

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Remote authenticated SQLi (PR:L, AC:L) via ID parameter typically yields full database read and write, so C:H/I:H; availability impact not established, so A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Sep 16, 2026 - 20:48 vuln.today

Severity Changed

Sep 16, 2026 - 20:23 NVD

MEDIUM LOW

CVSS changed

Sep 16, 2026 - 20:23 NVD

5.3 (MEDIUM) 2.1 (LOW)

CVE Published

Sep 16, 2026 - 20:00 cve.org

LOW 2.1

DescriptionCVE.org

A flaw has been found in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/leave/index.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.

AnalysisAI

SQL injection in itsourcecode Leave Management System 1.0 allows an authenticated remote user to manipulate the ID argument in /module/leave/index.php and potentially read or modify database contents. Publicly available exploit code exists, but the attack requires a valid session and the product is a niche PHP application unlikely to be internet-exposed in production, so our assessment treats this as a low-real-priority issue despite the genuine CWE-89 flaw. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires a valid authenticated session on the Leave Management System (CVSS PR:L), after which the attacker manipulates the ID argument sent to /module/leave/index.php to inject SQL. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a low-real-priority issue despite being a genuine SQL injection (CWE-89). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch identified at time of analysis; check https://itsourcecode.com/ and the VulDB advisory https://vuldb.com/vuln/405755 for an updated release, and upgrade Leave Management System 1.0 to a patched version when one is available. … Detailed patch versions, workarounds, and compensating controls in full report.