CVE-2026-92526

Publié : 16 septembre 2026

Modifié : 16 septembre 2026

Score CVSS

6.3

MEDIUM

Description détaillée

A flaw has been found in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/leave/index.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Références et Patchs

https://github.com/ltranquility/submit_repository/issues/14 https://itsourcecode.com/https://vuldb.com/cve/CVE-2026-92526 https://vuldb.com/submit/941040 https://vuldb.com/vuln/405755 https://vuldb.com/vuln/405755/cti

Dernières Vulnérabilités

CVE-2026-92816

ComfyUI before 0.30.0 fails to sanitize folder_name input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory. Attackers can load a crafted workflow that writes attacker-controlled content to arbitrary locations, enabling code execution through modified startup files or package initializers.

VOIR DÉTAILS

CVE-2026-92815

changedetection.io through 0.60.6 fails to validate the Goto URL action in browser steps, allowing unauthenticated attackers to access internal addresses. Attackers can supply arbitrary internal URLs in the optional_value parameter to retrieve responses from restricted network locations.

VOIR DÉTAILS

CVE-2026-92814

changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malicious markup in monitored page titles that reaches notification channels like email and Telegram as live content when the watch_title token is used in templates.

VOIR DÉTAILS