CVE-2022-41379

CVE-2022-41379 affects Online Leave Management System v1.0. The vulnerability is an arbitrary file upload in the component path /leave_system/classes/Users.php?f=save, allowing an attacker to execute arbitrary code via a crafted PHP file. The published metrics list a CVSS 3.1 base score of 7.2 (H...

CVE-2022-38303

The CVE-2022-38303 issue affects Online Leave Management System v1.0. A SQL injection vulnerability exists in the id parameter of the /employees/manage_leave_type.php endpoint, enabling potentially unauthorized data access or modification. Root cause: improper handling/sanitization of user-suppli...

CVE-2022-43179

Online Leave Management System v1.0 is affected by a SQL injection in /admin/?page=user/manage_user&id=. Root cause: unsafe construction of SQL via the id parameter leading to full access to data. CVSSv3.1 metrics indicate high impact on confidentiality, integrity, and availability (AV:N/AC:L/PR:...

CVE-2022-40927

CVE-2022-40927 affects Online Leave Management System v1.0. The vulnerability is a SQL Injection issue in the endpoint /leave_system/classes/Master.php?f=delete_designation caused by lack of input validation. Impact is described as potential unauthorized data access/illicit SQL execution with hig...

CVE-2022-40928

CVE-2022-40928 affects Online Leave Management System v1.0 and is due to a SQL Injection in the endpoint "/leave_system/classes/Master.php?f=delete_application". The root cause is lack of validation/externalization of SQL statements in that API path, enabling an attacker to manipulate the databas...

CVE-2022-40926

CVE-2022-40926 affects Online Leave Management System v1.0, with a SQL Injection flaw in the endpoint /leave_system/classes/Master.php?f=delete_leave_type caused by insufficient input validation. Multiple sources (Red Hat, CNVD, CNNVD, CVE listings) corroborate a high-severity vulnerability (CVSS...

CVE-2022-45008

Online Leave Management System v1.0 contains a stored cross-site scripting (XSS) vulnerability in the component /leave_system/admin/?page=maintenance/department. The flaw allows an attacker to run arbitrary web scripts or HTML by injecting a payload into the Name field under the Create New module...

CVE-2022-45009

CVE-2022-45009 affects Online Leave Management System v1.0. The issue is an arbitrary file upload vulnerability in the SystemSettings.php endpoint (/leave_system/classes/SystemSettings.php?f=update_settings) that can allow an attacker to execute arbitrary PHP code via a crafted file. The primary ...

CVE-2022-38302

The CVE-2022-38302 entry concerns Online Leave Management System v1.0 with a SQL injection flaw in /maintenance/manage_department.php, exploitable via the id parameter. The Red Hat, NVD, CVE records consistently describe a SQLi vulnerability arising from unsanitized input in that endpoint, impact...

CVE-2022-38304

CVE-2022-38304 concerns Online Leave Management System v1.0 with a SQL injection vulnerability exposed via the id parameter in /maintenance/manage_leave_type.php. The issue enables injection due to improper handling of the id input, aligning with CVSS 3.1 metrics indicating high impact on confide...

CVE-2021-40595

Affected software: SourceCodester Online Leave Management System v1. The CVE-2021-40595 issue is a SQL injection in the login flow: the username parameter sent to /leave_system/classes/Login.php can be used to execute arbitrary SQL commands. Root cause described as insufficient filtering/escaping...

CVE-2022-41355

Online Leave Management System v1.0 contains a SQL injection vulnerability. The flaw is in the delete_department path (/Master.php?f=delete_department) where the id parameter is used in SQL statements without proper validation. This can allow an attacker to manipulate queries and potentially acce...