PHPGurukul Employee Leave Management System 2.1 contains an Insecure Direct Object Reference (IDOR) vulnerability in leave-details.php. An authenticated user can change the leaveid parameter in the URL to access leave application details of other users.
References
| Link | Resource |
|---|---|
| https://github.com/rishb0/CVEs-Assigned/blob/main/CVE-2025-56254.md | Third Party Advisory |
Configurations
History
04 Sep 2025, 17:02
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/rishb0/CVEs-Assigned/blob/main/CVE-2025-56254.md - Third Party Advisory | |
| CPE | cpe:2.3:a:phpgurukul:employee_leave_management_system:2.1:*:*:*:*:*:*:* | |
| First Time |
Phpgurukul
Phpgurukul employee Leave Management System |
02 Sep 2025, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.3 |
| CWE | CWE-639 |
02 Sep 2025, 12:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-09-02 12:15
Updated : 2025-09-04 17:02
NVD link : CVE-2025-56254
Mitre link : CVE-2025-56254
CVE.ORG link : CVE-2025-56254
JSON object : View
Products Affected
phpgurukul
- employee_leave_management_system
CWE
CWE-639
Authorization Bypass Through User-Controlled Key