CVE-2026-15493 describes a cross-site scripting vulnerability in the Akpali9 Attendance-Management-System up to commit 70b91fe38f4195b701a45f0edcd4f42d5f64aeee. The issue arises from improper handling of the export_date parameter in the absent.php file, enabling remote attackers to execute script code in the context of the affected application. The product follows a rolling release model, and no official patch or remediation information is available. The vendor did not respond to early disclosure attempts.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the user's browser, potentially leading to session hijacking, information disclosure, or other user-targeted attacks. The vulnerability requires no privileges and can be triggered remotely, but user interaction is needed. The CVSS 4.0 vector indicates low attack complexity and low privileges required, with user interaction necessary and limited impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are available, users should monitor official channels for updates. In the meantime, consider applying input validation or output encoding on the export_date parameter as a temporary mitigation if possible.