Leave Management System EUVD-2026-81092

Requires a valid authenticated session on the Leave Management System (CVSS PR:L), after which the attacker manipulates the ID argument sent to /module/leave/index.php to inject SQL. No special non-default configuration or user interaction is needed (UI:N), and the attack is remote over the network (AV:N, AC:L). Limiting factors: authentication is mandatory, and real-world exposure is constrained because this is a niche itsourcecode application unlikely to be internet-exposed in production; there is no unauthenticated path per the available data.

This is a low-real-priority issue despite being a genuine SQL injection (CWE-89). The vendor's CVSS 4.0 base score is only 2.1 (AV:N/AC:L/PR:L/UI:N/VC:L/VI:L/VA:L), reflecting VulDB's characteristically conservative scoring for itsourcecode student-grade PHP applications - but that low-impact rating undersells a classic ID-parameter SQLi, which typically permits full database read (and often write) via UNION/boolean techniques; my independent assessment rates confidentiality/integrity higher. Signal cross-reference: POC=YES (public exploit on GitHub) but KEV=NO and no EPSS score is provided, so there is publicly available exploit code but NO evidence of active exploitation - these are distinct signals and must not be conflated. The CVSS 4.0 vector's E:P (Proof-of-Concept exploit maturity) corroborates the public POC. The net picture is a real, easily-weaponizable vuln in an obscure product: prioritization should be driven by whether this specific application is deployed, not by threat-intel urgency, since real-world exposure is minimal. Key limiter: PR:L means an account is required, so this is authenticated rather than unauthenticated exploitation.

An authenticated low-privilege user of the Leave Management System sends a crafted value in the ID argument to /module/leave/index.php, injecting SQL that the application concatenates unsanitized into a query. Because a public proof-of-concept already exists (GitHub issue on ltranquility/submit_repository), an attacker can copy the technique to dump credentials or other database contents, or tamper with leave records. Exploitation is remote over the network but requires a valid session (PR:L).