SourceCodester Leave Application System User Management cross site scripting

The XSS vulnerability in Leave Application System allows an attacker to inject arbitrary JavaScript code into web pages viewed by other users. This can be exploited to steal session cookies, redirect users to malicious websites, or modify the content of the application. The impact is amplified if the application is used by a large number of users or handles sensitive data. While the CVSS score is LOW, the ease of exploitation and potential for user compromise make this a significant concern, particularly in environments where user trust is paramount. The publicly disclosed nature of the exploit increases the likelihood of immediate exploitation.

Organizations using SourceCodester Leave Application System version 1.0, particularly those with limited security expertise or those who haven't implemented robust input validation and output encoding practices, are at significant risk. Shared hosting environments where multiple users share the same server are also particularly vulnerable, as an attacker could potentially compromise the entire server.

• php / web:

 grep -r 'User Management Handler' /var/www/html/

• generic web:

curl -I <application_url>/user_management_handler.php | grep -i 'X-XSS-Protection'

1. 2026-03-31Disclosure

   disclosure

1. Gereserveerd2026-03-31
2. Gepubliceerd2026-03-31
3. EPSS bijgewerkt2026-04-08

The primary mitigation is to upgrade to a patched version of SourceCodester Leave Application System as soon as it becomes available. Until then, implement strict input validation and output encoding on all user-supplied data, particularly within the User Management Handler. Employ a Web Application Firewall (WAF) with XSS filtering rules to block malicious requests. Regularly scan the application for XSS vulnerabilities using automated tools. Consider implementing Content Security Policy (CSP) to restrict the sources from which scripts can be executed.