SourceCodester Smart Attendance System: Password reset manipulation (CVE-2026-125074)
A flaw in the SourceCodester Smart Attendance System with QR Code Scanner 1.0 allows remote manipulation of username/password arguments during password recovery, resulting in weak password recovery.
CVE search metadata
CVE search record: CVE-2026-125074. Severity: high. CVSS: 7.3. KEV: no. Product: Smart Attendance System with QR Code Scanner (1.0). Brief: SourceCodester Smart Attendance System: Password reset manipulation (CVE-2026-125074). Brief link: https://feed.craftedsignal.io/briefs/2026-11-smart-attendance-password-reset/
Triage facts
Revision 1- Applicability
- Smart Attendance System with QR Code Scanner (1.0)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 10, 04:02 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A vulnerability exists in the reset_password.php file of the SourceCodester Smart Attendance System with QR Code Scanner 1.0. The flaw allows for the remote manipulation of username or password arguments within the password recovery component, leading to weak password recovery. An exploit for this vulnerability has been published.