CVE-2026-105776bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL admin_transaction.php sql injection
Updated under an hour ago ()
Does this affect you?
It affects bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 0.33%, higher than 24% of scored CVEs.
Do this next
Free account, 1 product
A flaw has been found in bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL up to ae783195ba7e0390d3b3bfaddd99944b7e9735a4. Affected by this vulnerability is an unknown functionality of the file /admin_transaction.php. This manipulation of the argument Username causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
- CVSS
- 7.3 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C
- Weakness (CWE)
- CWE-89, CWE-74
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 0.33% (percentile 24)
- Assigned by
- VulDB
- NVD analysis
- Deferred
- Record last updated
- Oct 6, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL bhagya3929:employee-movement-tracking-and-monitoring-website-for-iocl | ae783195ba7e0390d3b3bfaddd99944b7e9735a4 | CNA record |
References
- https://vuldb.com/vuln/413810vdb-entry, technical-description
- https://vuldb.com/vuln/413810/ctisignature, permissions-required
- https://vuldb.com/cve/CVE-2026-105776third-party-advisory
- https://vuldb.com/submit/992496third-party-advisory
- https://github.com/bhagya3929/Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL/issues/1exploit, issue-tracking
- https://github.com/bhagya3929/Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL/product
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.