{"id":"CVE-2026-124570","kind":"vulnerability","aliases":["CVE-2026-124570"],"related":[],"title":"SourceCodester Online Leave Management System: stored XSS via employee avatar filename","description":"A vulnerability was detected in SourceCodester Online Leave Management System 1.0. Affected is an unknown function of the file app/classes/Master.php of the component Employee Avatar Upload Extension. Performing a manipulation of the argument employee avatar filename results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now public and may be used.","summary":"The Employee Avatar Upload function in SourceCodester Online Leave Management System 1.0 does not sanitize the avatar filename in app/classes/Master.php. An attacker can inject script through that filename, which runs in the browser of anyone who views the affected page.","severity":"low","cvss":3.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["leave-management","other","php","self-hosted"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-09T06:17:58+00:00","first_seen_at":"2026-11-09T06:25:02+00:00","triaged_at":"2026-11-09T06:26:54+00:00","updated_at":"2026-11-09T06:26:54+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-09T06:26:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"SourceCodester Online Leave Management System: stored XSS via employee avatar filename","impact":"low","summary":"The Employee Avatar Upload function in SourceCodester Online Leave Management System 1.0 does not sanitize the avatar filename in app/classes/Master.php. An attacker can inject script through that filename, which runs in the browser of anyone who views the affected page.","audience":"businesses","category":"other","nicknames":[],"who_cares":["php","self-hosted","leave-management"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"script runs in other users' browsers, session data exposed","analyst_note":"Confirm whether avatar upload requires login and whether the exploit is public; no vendor fix stated in sources.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running SourceCodester Online Leave Management System 1.0 with the employee avatar upload feature in use. The sources do not say which other configurations are affected; unknown whether an account is needed to upload an avatar.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000678,"input_tokens":4565,"output_tokens":442,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-124570':14A,17A '-2026':13A,16A '1.0':37B,76C 'affect':64B,77C 'anyon':60B 'app/classes/master.php':45B,85C 'argument':98C 'attack':47B,111C 'avatar':10A,28B,42B,90C,100C 'browser':58B 'compon':88C 'cross':104C 'cve':12A,15A 'detect':69C 'employe':9A,27B,89C,99C 'exploit':108C,115C 'extens':92C 'file':84C 'filenam':11A,43B,53B,101C 'function':30B,81C 'host':25B 'inject':49B 'leav':3A,19B,34B,73C 'leave-manag':18B 'manag':4A,20B,35B,74C 'manipul':95C 'may':120C 'onlin':2A,33B,72C 'page':65B 'perform':93C 'php':22B 'possibl':113C 'public':118C 'remot':107C 'result':102C 'run':55B 'sanit':40B 'script':50B,106C 'self':24B 'self-host':23B 'site':105C 'sourcecodest':1A,32B,71C 'store':6A 'system':5A,36B,75C 'unknown':80C 'upload':29B,91C 'use':122C 'via':8A 'view':62B 'vulner':67C 'xss':7A","nicknames":[],"mitigations":[],"who_affected":"Organizations running SourceCodester Online Leave Management System 1.0 with the employee avatar upload feature in use. The sources do not say which other configurations are affected; unknown whether an account is needed to upload an avatar.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["leavemanagement","low","other","php","selfhosted"],"campaign_type":null,"search_a":"'-124570':14A,17A '-2026':13A,16A 'avatar':10A 'cve':12A,15A 'employe':9A 'filenam':11A 'leav':3A 'manag':4A 'onlin':2A 'sourcecodest':1A 'store':6A 'system':5A 'via':8A 'xss':7A","search_b":"'1.0':37B 'affect':64B 'anyon':60B 'app/classes/master.php':45B 'attack':47B 'avatar':28B,42B 'browser':58B 'employe':27B 'filenam':43B,53B 'function':30B 'host':25B 'inject':49B 'leav':19B,34B 'leave-manag':18B 'manag':20B,35B 'onlin':33B 'page':65B 'php':22B 'run':55B 'sanit':40B 'script':50B 'self':24B 'self-host':23B 'sourcecodest':32B 'system':36B 'upload':29B 'view':62B","search_c":"'1.0':76C 'affect':77C 'app/classes/master.php':85C 'argument':98C 'attack':111C 'avatar':90C,100C 'compon':88C 'cross':104C 'detect':69C 'employe':89C,99C 'exploit':108C,115C 'extens':92C 'file':84C 'filenam':101C 'function':81C 'leav':73C 'manag':74C 'manipul':95C 'may':120C 'onlin':72C 'perform':93C 'possibl':113C 'public':118C 'remot':107C 'result':102C 'script':106C 'site':105C 'sourcecodest':71C 'system':75C 'unknown':80C 'upload':91C 'use':122C 'vulner':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T06:17:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124570","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124570","severity":null,"published_at":"2026-11-09T06:17:58+00:00","modified_at":"2026-11-09T06:17:58+00:00","first_seen_at":"2026-11-09T06:25:02+00:00","fetched_at":"2026-11-09T06:25:02+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}