The vulnerability CVE-2026-92526 affects itsourcecode Leave Management System 1.0. It is caused by improper sanitization of the ID parameter in the /module/leave/index.php file, allowing an attacker to perform SQL injection. This can be triggered remotely without user interaction and requires low privileges. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no user interaction, and limited confidentiality, integrity, and availability impacts. Exploit code has been published, increasing the risk of exploitation.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium due to limited confidentiality, integrity, and availability impacts as per the CVSS vector. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor the vendor's communications for updates. In the meantime, restricting access to the vulnerable endpoint and applying web application firewall (WAF) rules to detect and block SQL injection attempts may reduce risk.