Is CVE-2026-10624 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10624 being exploited in the wild.

How severe is CVE-2026-10624?

Medium severity, with a CVSS score of 4.3, published 2 June 2026.

Which products and versions are affected?

SourceCodester Human Resource Management System 1.0.

Is there a fix for CVE-2026-10624?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-10624 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-10624?

Check whether you run SourceCodester Human Resource Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10624: SourceCodester Human Resource Management IDOR in detailview.php

CVE-2026-10624 · Severity: medium · CVSS 4.3 · Published 2026-06-02

A security flaw exists in SourceCodester Human Resource Management 1.0, a software used for managing employee records. An attacker with basic user access can manipulate web addresses to view sensitive employee information they are not authorized to see. This could lead to the exposure of private staff data and potential privacy compliance issues.

Vendors: SourceCodester.

Quick answers

Is CVE-2026-10624 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10624 being exploited in the wild.
How severe is CVE-2026-10624?: Medium severity, with a CVSS score of 4.3, published 2 June 2026.
Which products and versions are affected?: SourceCodester Human Resource Management System 1.0.
Is there a fix for CVE-2026-10624?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-10624 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-10624?: Check whether you run SourceCodester Human Resource Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in SourceCodester Human Resource Management 1.0 within the 'Employee View Page' component. The vulnerability is located in the /detailview.php file and stems from improper control of resource identifiers via the 'employeeid' parameter. A remote attacker with low-level authenticated privileges can manipulate this parameter to access records of other employees. This is classified as CWE-99 (Improper Control of Resource Identifiers). An exploit for this vulnerability has been disclosed publicly.

Affected products

SourceCodester Human Resource Management 1.0

Timeline

2026-06-02: disclosed: Vulnerability disclosed and CVE published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.