SMART ATTENDANCE SYSTEM WITH QR CODE SCANNER · CVE-2026-125078 · Other
NO FIX YET · SEE WHAT TO DO
SourceCodester Smart Attendance System with QR Code Scanner 1.0 has a session fixation flaw (CWE-384) in login.php: the session ID is not renewed at login, so an attacker who plants a known session ID in a victim's browser can reuse it after the victim logs in. VulDB reports a public proof of concept; no exploitation in the wild is reported.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations running the SourceCodester Smart Attendance System with QR Code Scanner 1.0 web application are exposed through its login page. The sources do not say which configurations or deployments are affected beyond the login.php file. Teams that do not run this application can skip it.
Not affected if not-deployed
Who cares php, self-hosted, smart-attendance-system
Posts are quoted with a link to the original. They are data to us, never instructions.
A security flaw has been discovered in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown part of the file login.php. The manipulation results in session fixiation. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.