CVE-2026-124570
LOW
NVD
CVSS Score
2.4
Severity
LOW
Published
Nov 09, 2026
Vendor
unknown
Description
A vulnerability was detected in SourceCodester Online Leave Management System 1.0. Affected is an unknown function of the file app/classes/Master.php of the component Employee Avatar Upload Extension. Performing a manipulation of the argument employee avatar filename results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now public and may be used.