Leave Management System EUVD-2026-119811

Exploitation requires an authenticated account with sufficient privileges (vector PR:H) to supply the employee avatar filename handled by the Employee Avatar Upload Extension in app/classes/Master.php, plus passive victim interaction (UI:P) - a second user must load the page that renders the stored filename for the injected script to fire. Limiting factors: this is not remote-unauthenticated (an attacker account is needed), impact is confined to low integrity in the victim's browser context (VC:N/VA:N), and no availability or data-exfiltration impact is indicated. The exact upload workflow and which roles can set the filename are not described in the available sources and should be confirmed against the deployment's role configuration.

This is a medium-severity stored cross-site scripting issue (CWE-79, CVSS 4.0 base 4.8) in SourceCodester Online Leave Management System 1.0, and the signals converge on low real-world priority rather than an urgent threat. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N) shows network reach and low attack complexity but requires high privileges (PR:H) and passive user interaction (UI:P), with impact limited to low integrity and no confidentiality or availability loss - consistent with injecting script that fires when a victim views the affected page. Exploit maturity is E:P (proof-of-concept), and the multi-source data shows a public PoC reference (GitHub issue) that is not verified as working exploit code; there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or automated exploitation. The vuln.today decision label is 'this_month', not act_now/emergency. The main tension is the PR:H rating: for a self-service avatar upload this privilege requirement looks high, and the exact trigger (who can upload the avatar and who renders the filename) is not described in the available sources, so the realistic attacker privilege should be verified against the application's role model. Overall this reads as a genuine but low-urgency bug in a small application, not a high-CVSS-but-overstated issue - the ceiling is capped by the limited impact and the required privileges and victim interaction.

An attacker who holds an account with upload rights in Online Leave Management System sets a malicious avatar filename containing an HTML/script payload via app/classes/Master.php; the stored value later renders unsanitized when another user (such as an administrator reviewing employees) loads the page, executing the script in that victim's browser session. A public PoC reference exists (GitHub issue) but it is not verified as working exploit code, and exploitation depends on the victim viewing the injected content (UI:P).