Login Request a demo
Medium severity · published Oct 1, 2026
CVE-2026-103543
itsourcecode Leave Management System controller.php sql injection
6.3
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability has been found in itsourcecode Leave Management System 1.0. The affected element is an unknown function of the file /module/leavetype/controller.php. Such manipulation of the argument LEAVTID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LM
Leave Management System · itsourcecode
1.0 · source: vendor
Affected product
LM
Leave Management System
itsourcecode
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-103543
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-103543
vdb-entry
https://vuldb.com/vuln/412353
signature
https://vuldb.com/vuln/412353/cti
third-party-advisory
https://vuldb.com/cve/CVE-2026-103543
third-party-advisory
https://vuldb.com/submit/957952
exploit
https://github.com/ltranquility/submit_repository/issues/17
product
https://itsourcecode.com/
More from Leave Management System
9.8
CVE-2025-11432
A vulnerability was identified in itsourcecode Leave Management System 1.0
7.3
CVE-2026-90789
itsourcecode Leave Management System login.php sql injection
6.3
CVE-2026-103690
itsourcecode Leave Management System controller.php sql injection
6.3
CVE-2026-95833
itsourcecode Leave Management System index.php sql injection
6.3
CVE-2026-94032
itsourcecode Leave Management System index.php sql injection