CVE-2026-3751

2.0 lowEPSS 0.3%

Low (2.0) in oretnom23 employee task management system. EPSS 0.3% chance of exploitation in the next 30 days.

A vulnerability was detected in SourceCodester Employee Task Management System 1.0. Impacted is an unknown function of the file /daily-attendance-report.php of the component GET Parameter Handler. The manipulation of the argument Date results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.

Severity

CVSS 4.0

2.0 low

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

7.2 high

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 25% of CVEs (scores of 2026-10-31)
CWEs: CWE-74, CWE-89
Published: 2026-03-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

oretnom23:employee_task_management_system

References

https://github.com/meifukun/Web-Security-PoCs/blob/main/Employee-Task-Management-System/SQLi-DailyAttendanceReport-date.md
https://vuldb.com/?ctiid.349729
https://vuldb.com/?id.349729
https://vuldb.com/?submit.768034
https://www.sourcecodester.com/

Check your stack JSON