RCE in Sourcecodester Online Leave Management System
CVE-2026-124570
A vulnerability was detected in SourceCodester Online Leave Management System 1.0. Affected is an unknown function of the file app/classes/Master.php of the component Employee Avatar Upload Extension. Performing a manipulation of the argument employee avatar filename results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now public and may be used.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 2.4 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Sourcecodester Online Leave Management System — versions 1.0
Weakness classification (CWE)
References
- VDB-432916 | SourceCodester Online Leave Management System Employee Avatar Upload Extension Master.php cross site scripting (technical-description, vdb-entry)
- VDB-432916 | CTI Indicators (IOB, IOC, TTP, IOA) (signature, permissions-required)
- CVE-2026-124570 | CVE Analysis and Report (third-party-advisory)
- Submit #1035914 | sourceCodester Online Leave Management System V1.0 Cross Site Scripting (third-party-advisory)
- github.com/cm126261/CVE/issues/1 (issue-tracking, exploit)
- www.sourcecodester.com/ (product)
Frequently asked questions
- What is CVE-2026-124570?
- CVE-2026-124570 is a low-severity vulnerability in Sourcecodester Online Leave Management System, classified under Cross-site Scripting. CVSS score: 2.4/10. Published 2026-11-09.
- How severe is CVE-2026-124570?
- Low severity. CVSS v3 base score is 2.4 out of 10.