The vulnerability CVE-2026-94032 affects itsourcecode Leave Management System 1.0. It is caused by improper sanitization of the ID parameter in the /module/department/index.php file, leading to SQL injection. This allows remote attackers to manipulate SQL queries by injecting malicious input through the ID argument. The vulnerability has been publicly disclosed with exploit code available, but there is no indication of active exploitation in the wild. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database of the Leave Management System. This may lead to unauthorized data access, modification, or deletion. However, the impact is limited as indicated by the CVSS vector, with low confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor the vendor's communications for updates. Until a patch is available, consider restricting access to the vulnerable endpoint or applying web application firewall rules to detect and block SQL injection attempts targeting the ID parameter.