---
id: "CVE-2026-125076"
page: "https://infrastack.ai/live/CVE-2026-125076"
kind: "vulnerability"
aliases: ["CVE-2026-125076"]
title: "SourceCodester Smart Attendance System: missing authentication on attendance endpoint"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "SourceCodester Smart Attendance System with QR Code Scanner", "fixed": [], "affected": "1.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["attendance-system", "other", "php", "self-hosted"]
not_affected_if: ["endpoint-not-exposed", "other-version"]
published_at: "2026-11-10T00:17:06+00:00"
first_seen_at: "2026-11-10T00:28:41+00:00"
updated_at: "2026-11-10T00:33:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125076", "first_seen_at": "2026-11-10T00:28:41+00:00"}, {"source": "analyst", "url": "https://vuldb.com/vuln/433180", "first_seen_at": "2026-11-10T00:33:41+00:00", "cites": ["https://vuldb.com/vuln/433180", "https://www.sourcecodester.com/php/18702/smart-attendance-system-qr-code-scanner-phpmysql.html"]}]
exploit_sources: []
---

# SourceCodester Smart Attendance System: missing authentication on attendance endpoint

Link for people: https://infrastack.ai/live/CVE-2026-125076 (this .md is for agents)

The SourceCodester Smart Attendance System with QR Code Scanner 1.0 has a JSON endpoint in api/attendance_handler.php that does not check authentication when the student_code argument is manipulated. A remote attacker can reach the endpoint without logging in, and a public exploit exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SourceCodester Smart Attendance System with QR Code Scanner affected 1.0 fixed no fixed version listed

## How to check

- Check whether you run Smart Attendance System with QR Code Scanner 1.0 (SourceCodester PHP/MySQL download).
- Request /api/attendance_handler.php from outside a logged-in session; if it answers JSON without login, you are exposed.
- Search your web logs for unauthenticated requests to api/attendance_handler.php with a student_code parameter.

## Fix

No fixed version known; neither VulDB nor the SourceCodester listing names a patch. Restrict access to api/attendance_handler.php (require login or block at the web server) or stop exposing the app.

## Timeline

- 2026-11-10T00:28:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125076
- 2026-11-10T00:33:41+00:00 analyst https://vuldb.com/vuln/433180 — Read VulDB VDB-433180 (CNA, not vendor): v1.0 api/attendance_handler.php, CWE-306, remote no-auth, PoC on GitHub (link not public on VulDB free view), no vendor fix or countermeasure stated. SourceCodester page is a free-download listing with no advisory; nothing verified. Not exploited in the wild per sources.

## Documents

- [advisory] VulDB VDB-433180: Smart Attendance System attendance_handler.php missing authentication https://vuldb.com/vuln/433180
- [describes] Smart Attendance System with QR Code Scanner (PHP/MySQL) - SourceCodester https://www.sourcecodester.com/php/18702/smart-attendance-system-qr-code-scanner-phpmysql.html

## From the sources

A vulnerability was found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. Affected is an unknown function of the file api/attendance_handler.php of the component JSON Endpoint. Performing a manipulation of the argument student_code results in missing authentication. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_