Vulnerability · Published Mar 8, 2026 · Assigned by VulDB
CVE-2026-3751SourceCodester Employee Task Management System GET Parameter daily-attendance-report.php sql injection
Medium 4.7
In plain English
A medium-severity SQL injection in Employee Task Management System from SourceCodester. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Official description
A vulnerability was detected in SourceCodester Employee Task Management System 1.0. Impacted is an unknown function of the file /daily-attendance-report.php of the component GET Parameter Handler. The manipulation of the argument Date results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SourceCodester | Employee Task Management System | 1.0 |
Weakness: CWE-89, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-349729 | SourceCodester Employee Task Management System GET Parameter daily-attendance-report.php sql injection vdb-entry, technical-description
- VDB-349729 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #768034 | SourceCodester Employee Task Management System 1.0 SQL Injection third-party-advisory
- https://github.com/meifukun/Web-Security-PoCs/blob/main/Employee-Task-Management-System/SQLi-DailyAttendanceReport-date.md exploit
- https://www.sourcecodester.com/ product