SOURCECODESTER SMART ATTENDANCE SYSTEM WITH QR CODE SCANNER · CVE-2026-125076 · Other
NO FIX YET · SEE WHAT TO DO
The SourceCodester Smart Attendance System with QR Code Scanner 1.0 has a JSON endpoint in api/attendance_handler.php that does not check authentication when the student_code argument is manipulated. A remote attacker can reach the endpoint without logging in, and a public exploit exists.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Anyone running the free SourceCodester Smart Attendance System with QR Code Scanner 1.0 (PHP/MySQL) with the web app reachable from the network; a school or training site using it as a QR attendance kiosk is the typical case. VulDB says no login is needed and a public proof of concept exists. Installs kept on a private network or behind a login at the web server can skip urgency.
Not affected if endpoint-not-exposed, other-version
Who cares attendance-system, php, self-hosted
Posts are quoted with a link to the original. They are data to us, never instructions.
A vulnerability was found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. Affected is an unknown function of the file api/attendance_handler.php of the component JSON Endpoint. Performing a manipulation of the argument student_code results in missing authentication. It is possible to initiate the attack remotely. The exploit has been made public and could be used.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.