{"id":"CVE-2026-10624","state":"PUBLISHED","title":"SourceCodester Human Resource Management Employee View detailview.php resource injection","description":"A vulnerability has been found in SourceCodester Human Resource Management 1.0. Affected by this vulnerability is an unknown functionality of the file /detailview.php of the component Employee View Page. Such manipulation of the argument employeeid leads to improper control of resource identifiers. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.","publishedAt":"2026-06-02T20:30:10.773Z","updatedAt":"2026-06-03T14:35:41.215Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["SourceCodester Human Resource Management"],"affected":[{"vendor":"SourceCodester","product":"Human Resource Management","versions":[{"version":"1.0","status":"affected"}],"cpes":["cpe:2.3:a:sourcecodester:human_resource_management:*:*:*:*:*:*:*:*"],"modules":["Employee View Page"]}],"references":["https://vuldb.com/vuln/367929","https://vuldb.com/vuln/367929/cti","https://vuldb.com/cve/CVE-2026-10624","https://vuldb.com/submit/829766","https://r4sh7n.medium.com/insecure-direct-object-reference-idor-vulnerability-in-employee-management-functionality-70df8ac5b1d3?postPublishedType=repub","https://www.sourcecodester.com/"],"weaknesses":["CWE-99"],"ingestedAt":"2026-10-29T20:10:33.477Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/10xxx/CVE-2026-10624.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-10624","state":"PUBLISHED","datePublished":"2026-06-02T20:30:10.773Z","dateUpdated":"2026-06-03T14:35:41.215Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-06-02T14:01:36.913Z"},"containers":{"cna":{"title":"SourceCodester Human Resource Management Employee View detailview.php resource injection","descriptions":[{"lang":"en","value":"A vulnerability has been found in SourceCodester Human Resource Management 1.0. Affected by this vulnerability is an unknown functionality of the file /detailview.php of the component Employee View Page. Such manipulation of the argument employeeid leads to improper control of resource identifiers. The attack may be performed from remote. The exploit has been disclosed to the public and may be used."}],"affected":[{"vendor":"SourceCodester","product":"Human Resource Management","versions":[{"version":"1.0","status":"affected"}],"cpes":["cpe:2.3:a:sourcecodester:human_resource_management:*:*:*:*:*:*:*:*"],"modules":["Employee View Page"]}],"references":[{"url":"https://vuldb.com/vuln/367929","name":"VDB-367929 | SourceCodester Human Resource Management Employee View detailview.php resource injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/367929/cti","name":"VDB-367929 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-10624","name":"CVE-2026-10624 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/829766","name":"Submit #829766 | SourceCodester  Human Resource Management 1.0 Insecure Direct Object Reference","tags":["third-party-advisory"]},{"url":"https://r4sh7n.medium.com/insecure-direct-object-reference-idor-vulnerability-in-employee-management-functionality-70df8ac5b1d3?postPublishedType=repub","tags":["broken-link","exploit"]},{"url":"https://www.sourcecodester.com/","tags":["product"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":4.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":4.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-99","type":"CWE","lang":"en","description":"Improper Control of Resource Identifiers"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-06-02T20:30:10.773Z"},"timeline":[{"time":"2026-06-02T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-06-02T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-06-02T16:06:40.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"r4sh7n (VulDB User)","type":"reporter"}],"tags":["x_freeware"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-06-03T14:34:37.861269Z","id":"CVE-2026-10624","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-06-03T14:35:41.215Z"}}]}}}