SourceCodester Leave Application System vulnerabilities

A vulnerability was identified in SourceCodester Leave Application System 1.0 in an unknown function of /index.php?page=manage_user within the User Information Handler component. Manipulation of the ID argument leads to authorization bypass, and the attack can be executed remotely. The exploit is publicly available and might be used.

SourceCodester Leave Application System 1.0 has a file inclusion vulnerability via manipulation of the page argument. A remote attacker can exploit this without authentication. The exploit has been made public.

A cross-site scripting vulnerability was found in SourceCodester Leave Application System 1.0 in the User Management Handler component. Remote attack is possible. Exploit is publicly available.