{"id":"CVE-2026-5209","state":"PUBLISHED","title":"SourceCodester Leave Application System User Management cross site scripting","description":"A security vulnerability has been detected in SourceCodester Leave Application System 1.0. Affected by this issue is some unknown functionality of the component User Management Handler. Such manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.","publishedAt":"2026-03-31T18:30:12.047Z","updatedAt":"2026-03-31T20:30:43.222Z","severity":{"score":4.8,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["SourceCodester Leave Application System"],"affected":[{"vendor":"SourceCodester","product":"Leave Application System","versions":[{"version":"1.0","status":"affected"}],"modules":["User Management Handler"]}],"references":["https://vuldb.com/vuln/354345","https://vuldb.com/vuln/354345/cti","https://vuldb.com/submit/780417","https://medium.com/@hemantrajbhati5555/stored-cross-site-scripting-xss-in-php-leave-application-system-3260c881a1fa","https://www.sourcecodester.com/"],"weaknesses":["CWE-79","CWE-94"],"ingestedAt":"2026-10-29T20:12:32.778Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/5xxx/CVE-2026-5209.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-5209","state":"PUBLISHED","datePublished":"2026-03-31T18:30:12.047Z","dateUpdated":"2026-03-31T20:30:43.222Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-03-31T10:18:21.484Z"},"containers":{"cna":{"title":"SourceCodester Leave Application System User Management cross site scripting","descriptions":[{"lang":"en","value":"A security vulnerability has been detected in SourceCodester Leave Application System 1.0. Affected by this issue is some unknown functionality of the component User Management Handler. Such manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed publicly and may be used."}],"affected":[{"vendor":"SourceCodester","product":"Leave Application System","versions":[{"version":"1.0","status":"affected"}],"modules":["User Management Handler"]}],"references":[{"url":"https://vuldb.com/vuln/354345","name":"VDB-354345 | SourceCodester Leave Application System User Management cross site scripting","tags":["vdb-entry"]},{"url":"https://vuldb.com/vuln/354345/cti","name":"VDB-354345 | CTI Indicators (IOB, IOC, TTP)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/780417","name":"Submit #780417 | SourceCodester Leave Application System in PHP and SQLite3 1.0 Cross Site Scripting","tags":["third-party-advisory"]},{"url":"https://medium.com/@hemantrajbhati5555/stored-cross-site-scripting-xss-in-php-leave-application-system-3260c881a1fa","tags":["broken-link","exploit"]},{"url":"https://www.sourcecodester.com/","tags":["product"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":4.8,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":2.4,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","baseSeverity":"LOW"}},{"cvssV3_0":{"version":"3.0","baseScore":2.4,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","baseSeverity":"LOW"}},{"cvssV2_0":{"version":"2.0","baseScore":3.3,"vectorString":"AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","type":"CWE","lang":"en","description":"Cross Site Scripting"}]},{"descriptions":[{"cweId":"CWE-94","type":"CWE","lang":"en","description":"Code Injection"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-03-31T18:30:12.047Z"},"timeline":[{"time":"2026-03-31T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-03-31T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-03-31T12:23:30.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"Hemant Raj Bhati (VulDB User)","type":"reporter"}],"tags":["x_freeware"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-03-31T20:30:32.902818Z","id":"CVE-2026-5209","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-03-31T20:30:43.222Z"}}]}}}