Vulnerability · Published Oct 13, 2026 · Assigned by VulDB

CVE-2026-108972SourceCodester Human Resource Management System Employee Endpoint employee.php session_start improper authentication

High 7.3

In plain English

A high-severity improper authentication in Human Resource Management System from SourceCodester. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.4%top 65.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in SourceCodester Human Resource Management System 1.0. Affected by this vulnerability is the function session_start of the file controller/employee.php of the component Employee Endpoint. The manipulation of the argument role/pfimg/EmpId results in improper authentication. It is possible to launch the attack remotely. The exploit has been made public and could be used.

Affected products (as reported)

Vendor	Product	Versions
SourceCodester	Human Resource Management System	1.0

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-416791 | SourceCodester Human Resource Management System Employee Endpoint employee.php session_start improper authentication vdb-entry, technical-description
VDB-416791 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
CVE-2026-108972 | CVE Analysis and Report third-party-advisory
Submit #1000486 | SourceCodester Human Resource Management System 10 No Auth Check on the Employee Endpoint: Anyone Creates an Admin, third-party-advisory
https://tracexlabs.com/releases/hrm-10-preauth-admin-takeover.html exploit, patch
https://www.sourcecodester.com/ product