Is there a public PoC exploit available for EUVD-2026-77616?

Yes, a public proof-of-concept exploit is available for EUVD-2026-77616. Prioritise patching immediately. EPSS: 0.2%.

Leave Management System EUVD-2026-77616

Q: What is the CVSS score of EUVD-2026-77616?

EUVD-2026-77616 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-90796 LOW

SQL Injection (CWE-89)

2026-09-14 VulDB

GHSA-3p56-4m9v-vc6w

PHP SQLi Leave Management System

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

Remote injectable parameter (AV:N/AC:L) but company module implies a low-priv authenticated session (PR:L); SQLi typically yields database read (C:H) with limited write and no availability loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Sep 15, 2026 - 11:36 vuln.today

Severity Changed

Sep 14, 2026 - 17:22 NVD

MEDIUM LOW

CVSS changed

Sep 14, 2026 - 17:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

CVE Published

Sep 14, 2026 - 16:00 cve.org

LOW 2.1

DescriptionCVE.org

A vulnerability was identified in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/company/index.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in itsourcecode Leave Management System 1.0 lets a low-privileged, authenticated user manipulate the 'ID' argument of /module/company/index.php to run attacker-controlled SQL against the application's database. The flaw is a classic CWE-89 injection reachable over the network with no user interaction, but it requires an existing account on the application (CVSS 4.0 PR:L; assessed CVSS 3.1 PR:L), which is the main barrier to abuse. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires reaching the authenticated company module at /module/company/index.php and supplying an attacker-controlled 'ID' argument that is concatenated into a SQL query without sanitization. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Signals converge on LOW real-world priority despite the SQL injection class carrying a scary reputation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch or fixed version was identified in the available intelligence at time of analysis, so remediation must currently rely on compensating controls. … Detailed patch versions, workarounds, and compensating controls in full report.