rootpwn

medium · CVSS v3 6.3 · CVSS v4 5.3 · EPSS 0.002

CVE-2026-93963

A SQL injection vulnerability exists in itsourcecode Leave Management System 1.0, triggered by manipulating the DEPTID parameter in /module/

Overview

A SQL injection vulnerability exists in itsourcecode Leave Management System 1.0, triggered by manipulating the DEPTID parameter in /module/department/controller.php. The flaw allows remote attackers to execute arbitrary SQL commands. It is publicly disclosed and can be exploited without authentication.

Description

A security vulnerability has been detected in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/department/controller.php. The manipulation of the argument DEPTID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.

Impact

Confidentiality: attackers can read sensitive employee data. Integrity: they can modify or delete records. Availability: potential for database lockout. Defenders include system administrators and database administrators.

Remediation

Apply the vendor’s patch or upgrade to the latest version of the Leave Management System. If patch unavailable, sanitize the DEPTID input, enforce parameterized queries, and restrict database user privileges to read-only where possible. Monitor logs for anomalous SQL activity.

Risk context

The CVSS v3 score of 6.3 indicates medium risk, while the EPSS of 0.002 suggests a very low likelihood of exploitation in the wild. Nonetheless, the vulnerability can be leveraged remotely, warranting timely remediation.

Affected products

  • itsourcecode Leave Management System 1.0
  • itsourcecode Leave Management System
  • Leave Management System
  • itsourcecode
  • LMS 1.0

Scores

Severity
medium
CVSS v2
6.5
CVSS v3
6.3
CVSS v4
5.3
EPSS
0.002

sql-injection web-application medium-severity remote-exploit input-validation database-attack EPSS-low

← All CVEs

Related CVEs

medium

CVE-2026-94032

A flaw has been found in itsourcecode Leave Management System 1.0. This affects an unknown part of the file /module/department/index.php. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.

View analysis

medium

CVE-2026-93956

A medium‑severity XSS flaw exists in olivier-ls PHP‑FTS up to 1.1.2. The vulnerability is triggered by manipulating the Query argument to SearchEngine::buildHighlights, allowing remote attackers to inject malicious scripts. It can be exploited via a web request to the affected component.

View analysis

medium

CVE-2026-92410

The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to delete sign-up records via a forged request handled in the session of a logged-in user with the required capability.

View analysis

medium

CVE-2026-92422

The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it into a shortcode string that it passes to the WordPress shortcode parser on a publicly reachable endpoint, allowing unauthenticated users to execute arbitrary registered shortcodes and disclose non-public gallery content.

View analysis