CVE-2025-1606

The CVE-2025-1606 entry affects SourceCodester Best Employee Management System 1.0, specifically the file /admin/backup/backups.php, where manipulation leads to information disclosure. Documents consistently state remote exploitation and that the public exploit is disclosed; vendor response is no...

CVE-2025-0802

CVE-2025-0802 affects SourceCodester Best Employee Management System 1.0 (Administrative Endpoint: /admin/View_user.php). The vulnerability causes improper access controls in the View_user.php function, enabling a remote attacker to access restricted functionality without required privileges. Mul...

CVE-2025-1592

Summary: CVE-2025-1592 affects SourceCodester Best Employee Management System 1.0, specifically the Add Role Page’s /admin/Operations/Role.php. The issue arises from manipulating the assign_name/description parameters, causing cross-site scripting that can be triggered remotely. The primary sourc...

CVE-2025-2046

CVE-2025-2046 affects SourceCodester Best Employee Management System 1.0. The issue is an SQL injection in the file /admin/print1.php triggered by manipulating the id parameter. This allows remote exploitation and could lead to unauthorized data access or modification, as indicated by multiple so...

CVE-2025-1607

CVE-2025-1607 affects SourceCodester Best Employee Management System 1.0, where manipulating the id parameter in /admin/salary_slip.php leads to an authorization bypass. The vulnerability arises in processing of the salary_slip password/ID input (unknown internal handling) and allows an attacker ...

CVE-2024-11214

CVE-2024-11214 involves SourceCodester Best Employee Management System 1.0. A vulnerability in the /admin/profile.php script allows manipulation of the website_image parameter to achieve unrestricted file upload. Exploitation can be performed remotely, and the issue is tied to the input handling ...

CVE-2025-1593

CVE-2025-1593 affects SourceCodester Best Employee Management System 1.0, specifically the Profile Picture Handler. The vulnerability resides in unrestricted file upload to the path /_hr_soft/assets/uploadImage/Profile/, allowing remote attackers to upload arbitrary files. The description consist...

CVE-2025-44184

SourceCodester Best Employee Management System v1.0 is affected by a Stored XSS in /admin/profile.php triggered via the website_image, fname, lname, contact, username, and address parameters. The root cause is described as improper cleanup of input in that file, enabling arbitrary JavaScript exec...

CVE-2025-44185

CVE-2025-44185 : In SourceCodester Best Employee Management System V1.0, a CSRF flaw exists in the admin password change action (/admin/change_pass.php) via the password parameter. The vulnerability could allow an attacker to trigger an unauthorized password change on behalf of an authenticated a...

CVE-2024-11212

SourceCodester Best Employee Management System 1.0 is affected by a SQL injection vulnerability in /admin/fetch_product_details.php via the barcode parameter. The issue is exploitable remotely and was disclosed in public advisories. The CVE is described as critical in some sources (e.g., CVSS/imp...

CVE-2024-11213

SourceCodester Best Employee Management System 1.0 is affected by a SQL injection in /admin/edit_role.php via the id parameter. The issue stems from improper input handling, enabling remote exploitation and has been publicly disclosed. Connected documents corroborate an SQL injection vulnerabilit...

CVE-2025-44186

SourceCodester Best Employee Management System 1.0 is vulnerable to Cross Site Request Forgery (CSRF) on /admin/Operation/User.php. The CVE (CVE-2025-44186) is linked to an CSRF that can lead to creation of an arbitrary user by an authenticated admin, per connected exploit references. Documented ...