High severity · published Sep 26, 2025
CVE-2025-11030
Tutorials-Website Employee Management System HTTP Request all-applied-leave.php improper authorization
7.3
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability was detected in Tutorials-Website Employee Management System up to 611887d8f8375271ce8abc704507d46340837a60. Impacted is an unknown function of the file /admin/all-applied-leave.php of the component HTTP Request Handler. The manipulation results in improper authorization. The attack may be performed from remote. The exploit is now public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EM
Employee Management System · Tutorials-Website
611887d8f8375271ce8abc704507d46340837a60 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-11030
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-11030
drive.google.com
https://drive.google.com/file/d/1N5ApKiYw-yKNhVERr4m3ruooiANgpFRo/view?usp=sharing
vuldb.com
https://vuldb.com/?ctiid.325969
vuldb.com
https://vuldb.com/?id.325969
vuldb.com
https://vuldb.com/?submit.657210
More from Employee Management System
6.5
CVE-2025-3536
A vulnerability was found in Tutorials-Website Employee Management System 1.0 and classified as critical
5.3
CVE-2025-3537
A vulnerability was found in Tutorials-Website Employee Management System 1.0
