CVE-2026-19987: Exposure of Information Through Directory Listing

A security vulnerability has been detected in SourceCodester Best Employee Management System 1.0. This affects an unknown function of the file /assets/uploadImage/Profile/. Such manipulation leads to exposure of information through directory listing. It is possible to launch the attack remotely...

PT-2026-73205

A security vulnerability has been detected in SourceCodester Best Employee Management System 1.0. This affects an unknown function of the file /assets/uploadImage/Profile/. Such manipulation leads to exposure of information through directory listing. It is possible to launch the attack remotely...

CVE-2025-44185: Cross-Site Request Forgery (CSRF)

SourceCodester Best Employee Management System V1.0 is vulnerable to Cross Site Request Forgery CSRF in /admin/changepass.php via the password parameter...

CVE-2025-44186

SourceCodester Best Employee Management System 1.0 is vulnerable to Cross Site Request Forgery CSRF in /admin/Operation/User.php page...

CVE-2025-44184: Improper Neutralization of Input During Web Page Generation

SourceCodester Best Employee Management System V1.0 is vulnerable to Cross Site Scripting XSS in /admin/profile.php via the websiteimage, fname, lname, contact, username, and address parameters...

CVE-2025-44186: Cross-Site Request Forgery (CSRF)

SourceCodester Best Employee Management System 1.0 is vulnerable to Cross Site Request Forgery CSRF in /admin/Operation/User.php page...

CVE-2025-2046

A vulnerability was found in SourceCodester Best Employee Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/print1.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The...

CVE-2025-2046: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in SourceCodester Best Employee Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/print1.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The...

CVE-2025-1607

A vulnerability, which was classified as problematic, has been found in SourceCodester Best Employee Management System 1.0. This issue affects some unknown processing of the file /admin/salaryslip.php. The manipulation of the argument id leads to authorization bypass. The attack may be initiated...

CVE-2025-1607: Authorization Bypass Through User-Controlled Key

A vulnerability, which was classified as problematic, has been found in SourceCodester Best Employee Management System 1.0. This issue affects some unknown processing of the file /admin/salaryslip.php. The manipulation of the argument id leads to authorization bypass. The attack may be initiated...

CVE-2025-1606: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability classified as problematic was found in SourceCodester Best Employee Management System 1.0. This vulnerability affects unknown code of the file /admin/backup/backups.php. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been...

CVE-2025-1593: Unrestricted Upload of File with Dangerous Type

A vulnerability classified as critical has been found in SourceCodester Best Employee Management System 1.0. This affects an unknown part of the file /hrsoft/assets/uploadImage/Profile/ of the component Profile Picture Handler. The manipulation leads to unrestricted upload. It is possible to...

CVE-2025-1592: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in SourceCodester Best Employee Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/Operations/Role.php of the component Add Role Page. The manipulation of the argument assignname/description...

PT-2025-7690

Name of the Vulnerable Software and Affected Versions SourceCodester Best Employee Management System version 1.0 Description A critical issue has been discovered, affecting the Profile Picture Handler component, specifically the file / hr soft/assets/uploadImage/Profile/. This issue allows for...

CVE-2025-0802: Improper Access Control

A vulnerability classified as critical was found in SourceCodester Best Employee Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/Viewuser.php of the component Administrative Endpoint. The manipulation leads to improper access controls. The atta...

CVE-2024-11214

A vulnerability has been found in SourceCodester Best Employee Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/profile.php. The manipulation of the argument websiteimage leads to unrestricted upload. The attack can be initiated remotely...

CVE-2024-11214

CVE-2024-11214 involves SourceCodester Best Employee Management System 1.0. A vulnerability in the /admin/profile.php script allows manipulation of the website_image parameter to achieve unrestricted file upload. Exploitation can be performed remotely, and the issue is tied to the input handling ...

PT-2024-16832

Name of the Vulnerable Software and Affected Versions SourceCodester Best Employee Management System version 1.0 Description A critical issue has been found in the SourceCodester Best Employee Management System, affecting the file /admin/profile.php. The manipulation of the website image argument...

CVE-2024-11213: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability, which was classified as critical, was found in SourceCodester Best Employee Management System 1.0. This affects an unknown part of the file /admin/editrole.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit...

CVE-2024-11214: Unrestricted Upload of File with Dangerous Type

A vulnerability has been found in SourceCodester Best Employee Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/profile.php. The manipulation of the argument websiteimage leads to unrestricted upload. The attack can be initiated remotely...