Quick answers
- Is CVE-2026-125075 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-125075 being exploited in the wild.
- How severe is CVE-2026-125075?
- High severity, with a CVSS score of 7.3, published 9 November 2026.
- Which products and versions are affected?
- SourceCodester Smart Attendance System with QR Code Scanner 1.0.
- Is there a fix for CVE-2026-125075?
- No fixed version is recorded yet. Remove create_admin.php from the web root after installation, or gate it with authentication checks. Never echo exception messages directly to clients; log errors server-side instead. Force a password change on first login and relocate installer scripts outside the document root or implement self-deletion after first execution.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-17","note":"Vulnerability identified and audited locally"},{"kind":"advisory","at":"2026-11-09","note":"CVE-2026-125075 published"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-125075 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-125075?
- Check whether you run SourceCodester Smart Attendance System with QR Code Scanner at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Remove create_admin.php from the web root after installation, or gate it with authentication checks. Never echo exception messages directly to clients; log errors server-side instead. Force a password change on first login and relocate installer scripts outside the document root or implement self-deletion after first execution.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-17","note":"Vulnerability identified and audited locally"},{"kind":"advisory","at":"2026-11-09","note":"CVE-2026-125075 published"}]
Technical details
The vulnerability is a missing authentication check (CWE-306) in create_admin.php, an installer script left in the web root. The script executes DDL (table creation) and inserts a hardcoded admin account on any GET request without session validation. Additionally, unhandled PDO exceptions echo raw database error messages to the client, disclosing schema details. An attacker needs only network access; no prior authentication or user interaction is required.
Affected products
- SourceCodester Smart Attendance System with QR Code Scanner 1.0