CVE-2026-108972 — SourceCodester Human Resource Management System Employee Endpoint employee.php session_start improper authentication
A vulnerability was found in SourceCodester Human Resource Management System 1.0. Affected by this vulnerability is the function session_start of the file controller/employee.ph…
Published: 2026-10-13 · CVSS: 6.9 · CVSS 4.0
A vulnerability was found in SourceCodester Human Resource Management System 1.0. Affected by this vulnerability is the function session_start of the file controller/employee.php of the component Employee Endpoint. The manipulation of the argument role/pfimg/EmpId results in improper authentication. It is possible to launch the attack remotely. The exploit has been made public and could be used.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7