CVE-2026-108972

EUVD-2026-98301
A vulnerability was found in SourceCodester Human Resource Management System 1.0. Affected by this vulnerability is the function session_start of the file controller/employee.php of the component Employee Endpoint. The manipulation of the argument role/pfimg/EmpId results in improper authentication. It is possible to launch the attack remotely. The exploit has been made public and could be used.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.3 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 50.29%
Common Weakness Enumeration
References
https://tracexlabs.com/releases/hrm-10-preauth-admin-takeover.html
https://vuldb.com/cve/CVE-2026-108972
https://vuldb.com/submit/1000486
https://vuldb.com/vuln/416791
https://vuldb.com/vuln/416791/cti
https://www.sourcecodester.com/