CVE-2026-125074

A flaw has been found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown function of the file reset_password.php of the component Password Reset. This manipulation of the argument username/password causes weak password recovery. The attack is possible to be carried out remotely. The exploit has been published and may be used.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.3 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://vuldb.com/vuln/433178
https://vuldb.com/vuln/433178/cti
https://vuldb.com/cve/CVE-2026-125074
https://vuldb.com/submit/1041011
https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/VULN-01-Unauthenticated-Password-Reset.md
https://www.sourcecodester.com/