Is CVE-2026-125074 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-125074 being exploited in the wild.

How severe is CVE-2026-125074?

High severity, with a CVSS score of 7.3, published 9 November 2026.

How is CVE-2026-125074 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-125074?

Check whether you run SourceCodester Smart Attendance System with QR Code Scanner at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-125074: SourceCodester Smart Attendance System missing authentication in password reset

CVE-2026-125074 · Severity: high · CVSS 7.3 · Published 2026-11-09

SourceCodester's Smart Attendance System is a PHP application used to manage student attendance and class records. An unauthenticated attacker can reset any user's password—including the administrator's—without logging in, gaining full control of the system and access to all student and attendance data. The vulnerability allows account creation as well, enabling persistent backdoor access.

Technologies: SourceCodester Smart Attendance System with QR Code Scanner. Vendors: SourceCodester.

Quick answers

Is CVE-2026-125074 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-125074 being exploited in the wild.
How severe is CVE-2026-125074?: High severity, with a CVSS score of 7.3, published 9 November 2026.
Which products and versions are affected?: SourceCodester Smart Attendance System with QR Code Scanner 1.0.
Is there a fix for CVE-2026-125074?: No fixed version is recorded yet. Remove reset_password.php from the web root entirely, or if password reset functionality is needed, add authentication via includes/auth.php and require verification of the current password before allowing any password change. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-125074 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-125074?: Check whether you run SourceCodester Smart Attendance System with QR Code Scanner at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Remove reset_password.php from the web root entirely, or if password reset functionality is needed, add authentication via includes/auth.php and require verification of the current password before allowing any password change.

Technical details

The reset_password.php endpoint lacks authentication checks (CWE-306) and processes POST requests containing username and password parameters without verifying the requester's identity. An unauthenticated remote attacker can overwrite any account's password or create a new administrative account, leading to complete application compromise. The vulnerability is trivially exploitable via HTTP POST and has documented proof-of-concept code.

Affected products

SourceCodester Smart Attendance System with QR Code Scanner 1.0

Timeline

2026-11-09: disclosed: CVE-2026-125074 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.