Leave Management System
Monthly
SQL injection in itsourcecode Leave Management System 1.0 lets an authenticated attacker with a low-privilege session (PR:L per the CVSS vectors) read and tamper with database contents through the ID parameter of /module/department/index.php; our independent assessment rates confidentiality impact high and integrity impact low. Publicly available exploit code exists, and the attack is network-reachable with no user interaction and no non-default configuration required. Real-world risk is moderate-to-low despite the published exploit, because the vulnerable endpoint sits inside the authenticated department administration module and the product itself is a rarely deployed hobbyist PHP application.
SQL injection in itsourcecode Leave Management System 1.0 allows an authenticated user to manipulate the DEPTID argument of /module/department/controller.php and inject arbitrary SQL into the application's backend queries. Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), the primary impact is high confidentiality loss with limited integrity effect, and exploitation requires a valid application session (PR:L) - no user interaction or non-default configuration is needed beyond the department module being reachable. Publicly available exploit code exists (a public proof-of-concept is referenced at github.com/VivianQYW/cve/issues/2 and the VulDB entry 407922), so the technical barrier to weaponization is low, though real-world risk is tempered by the product's very small deployment footprint; there is no indication of confirmed active exploitation (CISA KEV).
SQL injection in itsourcecode Leave Management System 1.0 allows an authenticated remote user to manipulate the ID argument in /module/leave/index.php and potentially read or modify database contents. Publicly available exploit code exists, but the attack requires a valid session and the product is a niche PHP application unlikely to be internet-exposed in production, so our assessment treats this as a low-real-priority issue despite the genuine CWE-89 flaw. No CISA KEV confirmation is provided.
SQL injection in the ID parameter of /module/employee/index.php in itsourcecode Leave Management System 1.0 allows an attacker holding a low-privilege authenticated session to read sensitive records and partially modify database contents, with no user interaction and no special configuration required. Publicly available exploit code exists, disclosed through a public GitHub issue and catalogued by VulDB, but there is no CISA KEV listing and therefore no confirmation of active exploitation. Our independent re-assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) treats the confidentiality impact as High and rates the issue more seriously than the CVSS 4.0 base score of 2.1 attached to the VulDB entry, although the practical risk is constrained by the product's extremely small real-world deployment footprint.
SQL injection in itsourcecode Leave Management System 1.0 lets a low-privileged, authenticated user manipulate the 'ID' argument of /module/company/index.php to run attacker-controlled SQL against the application's database. The flaw is a classic CWE-89 injection reachable over the network with no user interaction, but it requires an existing account on the application (CVSS 4.0 PR:L; assessed CVSS 3.1 PR:L), which is the main barrier to abuse. Publicly available exploit code exists (a proof-of-concept is linked from the VulDB submission and a GitHub issue), so the practical barrier is low for anyone who already holds credentials; however, EPSS is only 0.25% (16th percentile) and there is no CISA KEV listing, so signals converge on LOW real-world priority despite the injection class.
Unauthenticated SQL injection in itsourcecode Leave Management System 1.0 lets a remote attacker manipulate the user_email argument of /login.php to alter the authentication query and read or subvert backend data. Exploit code has been made publicly available (reflected as exploit maturity E:P in the CVSS 4.0 vector and referenced from a GitHub issue), so any internet-reachable deployment should be treated as immediately attackable. The flaw is not listed in CISA KEV and no EPSS score was supplied, so active in-the-wild exploitation is not confirmed — but the low attack complexity and zero authentication requirement make opportunistic scanning likely.
SQL injection in CodeAstro Leave Management System 1.0 exposes the application's database to remote authenticated attackers via the `type_of_leave` parameter in `/admin/add_leave.php`. The vulnerability (CWE-89) allows manipulation of backend SQL queries, potentially enabling data extraction, modification, or destruction. A publicly available exploit exists per VulDB report and a referenced GitHub proof-of-concept, elevating practical risk despite the low CVSS 4.0 base score of 2.1.
SQL injection in CodeAstro Leave Management System 1.0 allows authenticated remote attackers to manipulate database queries via the Name parameter in /admin/search_staff_for_updation.php. The vulnerability enables read, write, and denial-of-service impact against the underlying database with low complexity and no user interaction required. No public exploit code or active exploitation has been identified at time of analysis.
SQL injection in CodeAstro Leave Management System 1.0 allows low-privileged authenticated remote attackers to manipulate database queries via the `Name` parameter in the admin endpoint `/admin/search_staff_to_assign_pc.php`. Per the CVSS 4.0 vector, impact is limited to low confidentiality, integrity, and availability on the vulnerable system (VC:L/VI:L/VA:L) with no scope change to subsequent systems. Publicly available exploit code exists via a GitHub issue, though no active exploitation is confirmed in CISA KEV, and no vendor-released patch has been identified at time of analysis.
SQL injection in CodeAstro Leave Management System 1.0 exposes the /admin/delete_leave_type.php endpoint to arbitrary database query manipulation via the unsanitized leave_type parameter. The CVSS 4.0 vector (PR:L) confirms that a low-privileged authenticated user can remotely trigger the injection without user interaction or additional attack complexity. A publicly available exploit exists on GitHub (no public exploit identified in CISA KEV), and the CVSS 4.0 score of 2.1 reflects limited confidentiality, integrity, and availability impact confined to the vulnerable component with no lateral scope change.
SQL injection in CodeAstro Leave Management System 1.0 allows remote authenticated attackers to manipulate database queries via the Name parameter in /admin/search_staff_for_deletion.php. The vulnerability is a classic CWE-89 unsanitized input flaw in a PHP-based web application, enabling read, write, and limited availability impact against the underlying database. Publicly available exploit code exists per VulDB disclosure; no KEV listing indicates opportunistic rather than targeted exploitation at this time.
SQL injection in CodeAstro Leave Management System 1.0 allows authenticated remote attackers to manipulate the `email_id` parameter in `/admin/add_staff.php`, enabling arbitrary SQL query manipulation against the underlying database. The CVSS 4.0 score of 2.1 (Low) reflects constrained impact scope - confidentiality, integrity, and availability are each rated Low with no lateral impact to subsequent systems - and EPSS at 0.03% (8th percentile) indicates negligible real-world exploitation probability despite a publicly available proof-of-concept on GitHub. No active exploitation has been confirmed and this CVE is not listed in the CISA KEV catalog.
SQL injection in CodeAstro Leave Management System 1.0 allows remote unauthenticated attackers to manipulate the txt_username parameter in /login.php, enabling database queries to be executed with low confidentiality and integrity impact. Publicly available exploit code exists for this vulnerability, increasing real-world exploitation risk despite the moderate CVSS score of 5.5.
Reflected cross-site scripting (XSS) in itsourcecode Leave Management System 1.0 allows authenticated remote attackers to inject malicious scripts via the ID query parameter in /module/employee/controller.php?action=reset, requiring user interaction to execute. Public exploit code is available, though the vulnerability carries low real-world risk (EPSS 0.03%, CVSS 2.0) due to authentication and user-interaction requirements limiting broad exploitation.
SQL injection in itsourcecode Leave Management System 1.0 allows remote attackers to manipulate database queries via the employid parameter in /reset.php. A public proof-of-concept exploit exists, but the EPSS exploitation probability is very low (0.03%), suggesting limited real‑world exploitation despite ease of attack. No active exploitation (CISA KEV) has been reported, and the vendor has not issued a patch.
Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Jorani Leave Management System 1.0.2 allows a remote attacker to spoof a Host header associated with password reset emails. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue in Jorani Leave Management System 1.0.3 allows a remote attacker to execute arbitrary HTML code via a crafted script to the comment field of the List of Leave requests page. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in itsourcecode Leave Management System 1.0 lets an authenticated attacker with a low-privilege session (PR:L per the CVSS vectors) read and tamper with database contents through the ID parameter of /module/department/index.php; our independent assessment rates confidentiality impact high and integrity impact low. Publicly available exploit code exists, and the attack is network-reachable with no user interaction and no non-default configuration required. Real-world risk is moderate-to-low despite the published exploit, because the vulnerable endpoint sits inside the authenticated department administration module and the product itself is a rarely deployed hobbyist PHP application.
SQL injection in itsourcecode Leave Management System 1.0 allows an authenticated user to manipulate the DEPTID argument of /module/department/controller.php and inject arbitrary SQL into the application's backend queries. Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), the primary impact is high confidentiality loss with limited integrity effect, and exploitation requires a valid application session (PR:L) - no user interaction or non-default configuration is needed beyond the department module being reachable. Publicly available exploit code exists (a public proof-of-concept is referenced at github.com/VivianQYW/cve/issues/2 and the VulDB entry 407922), so the technical barrier to weaponization is low, though real-world risk is tempered by the product's very small deployment footprint; there is no indication of confirmed active exploitation (CISA KEV).
SQL injection in itsourcecode Leave Management System 1.0 allows an authenticated remote user to manipulate the ID argument in /module/leave/index.php and potentially read or modify database contents. Publicly available exploit code exists, but the attack requires a valid session and the product is a niche PHP application unlikely to be internet-exposed in production, so our assessment treats this as a low-real-priority issue despite the genuine CWE-89 flaw. No CISA KEV confirmation is provided.
SQL injection in the ID parameter of /module/employee/index.php in itsourcecode Leave Management System 1.0 allows an attacker holding a low-privilege authenticated session to read sensitive records and partially modify database contents, with no user interaction and no special configuration required. Publicly available exploit code exists, disclosed through a public GitHub issue and catalogued by VulDB, but there is no CISA KEV listing and therefore no confirmation of active exploitation. Our independent re-assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) treats the confidentiality impact as High and rates the issue more seriously than the CVSS 4.0 base score of 2.1 attached to the VulDB entry, although the practical risk is constrained by the product's extremely small real-world deployment footprint.
SQL injection in itsourcecode Leave Management System 1.0 lets a low-privileged, authenticated user manipulate the 'ID' argument of /module/company/index.php to run attacker-controlled SQL against the application's database. The flaw is a classic CWE-89 injection reachable over the network with no user interaction, but it requires an existing account on the application (CVSS 4.0 PR:L; assessed CVSS 3.1 PR:L), which is the main barrier to abuse. Publicly available exploit code exists (a proof-of-concept is linked from the VulDB submission and a GitHub issue), so the practical barrier is low for anyone who already holds credentials; however, EPSS is only 0.25% (16th percentile) and there is no CISA KEV listing, so signals converge on LOW real-world priority despite the injection class.
Unauthenticated SQL injection in itsourcecode Leave Management System 1.0 lets a remote attacker manipulate the user_email argument of /login.php to alter the authentication query and read or subvert backend data. Exploit code has been made publicly available (reflected as exploit maturity E:P in the CVSS 4.0 vector and referenced from a GitHub issue), so any internet-reachable deployment should be treated as immediately attackable. The flaw is not listed in CISA KEV and no EPSS score was supplied, so active in-the-wild exploitation is not confirmed — but the low attack complexity and zero authentication requirement make opportunistic scanning likely.
SQL injection in CodeAstro Leave Management System 1.0 exposes the application's database to remote authenticated attackers via the `type_of_leave` parameter in `/admin/add_leave.php`. The vulnerability (CWE-89) allows manipulation of backend SQL queries, potentially enabling data extraction, modification, or destruction. A publicly available exploit exists per VulDB report and a referenced GitHub proof-of-concept, elevating practical risk despite the low CVSS 4.0 base score of 2.1.
SQL injection in CodeAstro Leave Management System 1.0 allows authenticated remote attackers to manipulate database queries via the Name parameter in /admin/search_staff_for_updation.php. The vulnerability enables read, write, and denial-of-service impact against the underlying database with low complexity and no user interaction required. No public exploit code or active exploitation has been identified at time of analysis.
SQL injection in CodeAstro Leave Management System 1.0 allows low-privileged authenticated remote attackers to manipulate database queries via the `Name` parameter in the admin endpoint `/admin/search_staff_to_assign_pc.php`. Per the CVSS 4.0 vector, impact is limited to low confidentiality, integrity, and availability on the vulnerable system (VC:L/VI:L/VA:L) with no scope change to subsequent systems. Publicly available exploit code exists via a GitHub issue, though no active exploitation is confirmed in CISA KEV, and no vendor-released patch has been identified at time of analysis.
SQL injection in CodeAstro Leave Management System 1.0 exposes the /admin/delete_leave_type.php endpoint to arbitrary database query manipulation via the unsanitized leave_type parameter. The CVSS 4.0 vector (PR:L) confirms that a low-privileged authenticated user can remotely trigger the injection without user interaction or additional attack complexity. A publicly available exploit exists on GitHub (no public exploit identified in CISA KEV), and the CVSS 4.0 score of 2.1 reflects limited confidentiality, integrity, and availability impact confined to the vulnerable component with no lateral scope change.
SQL injection in CodeAstro Leave Management System 1.0 allows remote authenticated attackers to manipulate database queries via the Name parameter in /admin/search_staff_for_deletion.php. The vulnerability is a classic CWE-89 unsanitized input flaw in a PHP-based web application, enabling read, write, and limited availability impact against the underlying database. Publicly available exploit code exists per VulDB disclosure; no KEV listing indicates opportunistic rather than targeted exploitation at this time.
SQL injection in CodeAstro Leave Management System 1.0 allows authenticated remote attackers to manipulate the `email_id` parameter in `/admin/add_staff.php`, enabling arbitrary SQL query manipulation against the underlying database. The CVSS 4.0 score of 2.1 (Low) reflects constrained impact scope - confidentiality, integrity, and availability are each rated Low with no lateral impact to subsequent systems - and EPSS at 0.03% (8th percentile) indicates negligible real-world exploitation probability despite a publicly available proof-of-concept on GitHub. No active exploitation has been confirmed and this CVE is not listed in the CISA KEV catalog.
SQL injection in CodeAstro Leave Management System 1.0 allows remote unauthenticated attackers to manipulate the txt_username parameter in /login.php, enabling database queries to be executed with low confidentiality and integrity impact. Publicly available exploit code exists for this vulnerability, increasing real-world exploitation risk despite the moderate CVSS score of 5.5.
Reflected cross-site scripting (XSS) in itsourcecode Leave Management System 1.0 allows authenticated remote attackers to inject malicious scripts via the ID query parameter in /module/employee/controller.php?action=reset, requiring user interaction to execute. Public exploit code is available, though the vulnerability carries low real-world risk (EPSS 0.03%, CVSS 2.0) due to authentication and user-interaction requirements limiting broad exploitation.
SQL injection in itsourcecode Leave Management System 1.0 allows remote attackers to manipulate database queries via the employid parameter in /reset.php. A public proof-of-concept exploit exists, but the EPSS exploitation probability is very low (0.03%), suggesting limited real‑world exploitation despite ease of attack. No active exploitation (CISA KEV) has been reported, and the vendor has not issued a patch.
Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Jorani Leave Management System 1.0.2 allows a remote attacker to spoof a Host header associated with password reset emails. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue in Jorani Leave Management System 1.0.3 allows a remote attacker to execute arbitrary HTML code via a crafted script to the comment field of the List of Leave requests page. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.