CVE-2026-124570 Details
Description
A vulnerability was detected in SourceCodester Online Leave Management System 1.0. Affected is an unknown function of the file app/classes/Master.php of the component Employee Avatar Upload Extension. Performing a manipulation of the argument employee avatar filename results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now public and may be used.
A stored cross-site scripting vulnerability has been identified in SourceCodester Online Leave Management System version 1.0. The issue arises in the Employee Avatar Upload Extension, specifically within the file app/classes/Master.php. The vulnerability is triggered by manipulating the employee avatar filename, which is not properly sanitized before being rendered. This flaw allows for the execution of attacker-controlled JavaScript in the context of the user's browser, potentially leading to session hijacking or unauthorized actions within the application.
It is recommended to apply context-aware output encoding before rendering user-controlled data in HTML, JavaScript, or URL contexts. Additionally, use a strict server-side HTML sanitizer when rich text is required, generate safe server-side filenames for uploaded files, and validate field length and character sets at input boundaries.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/cm126261/CVE/issues/1 | [email protected] | ExploitIssue TrackingTechnical Description |
| https://vuldb.com/cve/CVE-2026-124570 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1035914 | [email protected] | Permission Required |
| https://vuldb.com/vuln/432916 | [email protected] | Permission Required |
| https://vuldb.com/vuln/432916/cti | [email protected] | Content Wall |
| https://www.sourcecodester.com/ | [email protected] | Vendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SourceCodester Online Leave Management System | V1.0 |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 9, 2026 | New CVE Received | [email protected] |