CVE-2026-5210
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
SourceCodester Leave Application System 1.0 has a file inclusion vulnerability via manipulation of the page argument. A remote attacker can exploit this without authentication. The exploit has been made public.
Risk Assessment
An attacker can include arbitrary files from the server, potentially leading to disclosure of sensitive data or server-side code execution.
Recommendation
Immediately disable SourceCodester Leave Application System until patches are released or apply appropriate security measures such as input validation.
Other vulnerabilities in SourceCodester Leave Application System
See all- CVE-2026-5326Medium
A vulnerability was identified in SourceCodester Leave Application System 1.0 in an unknown function of /index.php?page=manage_user within the User Information Handler component. Manipulation of the ID argument leads to authorization bypass, and the attack can be executed remotely. The exploit is publicly available and might be used.
- CVE-2026-5209Low
A cross-site scripting vulnerability was found in SourceCodester Leave Application System 1.0 in the User Management Handler component. Remote attack is possible. Exploit is publicly available.
Original NVD description (English source)
A vulnerability was detected in SourceCodester Leave Application System 1.0. This affects an unknown part. Performing a manipulation of the argument page results in file inclusion. Remote exploitation of the attack is possible. The exploit is now public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS