The vulnerability CVE-2026-103543 affects itsourcecode Leave Management System 1.0. It is caused by SQL injection due to improper sanitization of the LEAVTID parameter in an unspecified function within /module/leavetype/controller.php. This allows remote attackers to inject SQL commands by manipulating the LEAVTID argument. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and low impacts on confidentiality, integrity, and availability. The exploit has been publicly disclosed. No patch or remediation information is provided.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database remotely, potentially leading to unauthorized data access or modification. The impact is rated medium based on the CVSS score and vector, indicating limited but non-negligible risk.

No official patch or remediation has been provided by the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting access to the vulnerable endpoint and monitor for suspicious activity related to the LEAVTID parameter.