CVE-2026-37596

SourceCodester Online Employees Work From Home Attendance System version 1.0 contains a SQL Injection vulnerability in the manage_department.php administrative file that could allow attackers to execute unauthorized database queries. The vulnerability has a CVSS score of 2.7 (Low severity) with a network attack vector requiring high privilege credentials and no user interaction, resulting in limited confidentiality impact. The exploit presents minimal risk to the broader threat landscape, with an EPSS score of 0.00028 indicating very low probability of active exploitation, no known public exploit code availability, and no current inclusion on CISA's Known Exploited Vulnerabilities catalog. This vulnerability primarily affects organizations running the specific version of this attendance tracking system and poses a manageable security posture due to its requirement for high-privilege access. Patching should follow standard vulnerability management procedures but is not considered an urgent priority given the constrained attack surface and low exploitation likelihood.