CVE-2026-103690

MediumCVSS 6.3/10Last modified Oct 1, 2026

Description

A flaw has been found in itsourcecode Leave Management System 1.0. This vulnerability affects unknown code of the file /module/leave/controller.php. Executing a manipulation of the argument LEAVEID can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Oct 1, 2026
Last modified
Oct 1, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1036929.8The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticatCVE-2026-1036948.8The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logged-in user can update through one ofCVE-2026-1036958.6The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauCVE-2026-1036966.8The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauCVE-2026-10376.1IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. TCVE-2026-1037529.8Unauthenticated Privilege Escalation in Authorizer <= 3.15.3 versions.CVE-2026-1037545.9A flaw was found in ansible-runner. The unstream_dir() function, which receives and extracts a streamed zip archive on the worker side of thCVE-2026-1037577.7Budibase through 3.41.0 contains a server-side request forgery vulnerability in AI table generation because the uploadUrl function in packagCVE-2026-1037588.1Obot 0.21.1 through 0.24.1 contains an authorization bypass vulnerability that allows authenticated users to reach MCP servers because the cCVE-2026-1037605.9Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated remote attackers to bloCVE-2026-1037617.5Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePeerNotify that allows CVE-2026-1037625.3SiYuan before v3.8.5 contains a missing authorization vulnerability in the getRefCreateSavePath, getShorthandSavePath, and getDocCreateSaveP
CVE-2026-103690: Medium severity, CVSS 6.3 | Vulnix