CVE-2026-95833

A flaw has been found in itsourcecode Leave Management System 1.0. This vulnerability affects unknown code of the file /module/leave/controller.php. Executing a manipulation of the argument LEAVEID can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.

A vulnerability has been found in itsourcecode Leave Management System 1.0. An unknown function in /module/leavetype/controller.php allows manipulation of the LEAVTID argument leading to SQL injection. The attack can be launched remotely and the exploit has been publicly disclosed.

A flaw was found in itsourcecode Leave Management System 1.0 in an unknown part of the file /module/department/index.php. Manipulation of the argument ID causes SQL injection. The attack can be initiated remotely and the exploit has been published.

A security vulnerability has been detected in itsourcecode Leave Management System 1.0 affecting an unknown function of the file /module/department/controller.php. Manipulation of the DEPTID argument leads to SQL injection, and the attack can be initiated remotely. The exploit has been disclosed publicly and may be used.

A SQL injection vulnerability was identified in itsourcecode Leave Management System 1.0 in an unknown function of the file /module/company/index.php. Manipulation of the ID argument allows remote attack. The exploit is publicly available and might be used.

A flaw was found in Leave Management System 1.0 in the file /admin/add_staff.php. Manipulation of the email_id argument leads to SQL injection. The attack can be launched remotely, and the exploit is publicly available.

A cross-site scripting (XSS) vulnerability was discovered in itsourcecode Leave Management System 1.0 in the redirect function of /module/employee/controller.php?action=reset. Manipulating the ID argument allows remote attack execution. The exploit has been published and may be used.