CVE-2026-125076
Deferred Deferred - Pending Action

Authentication Bypass in Smart Attendance System QR Scanner

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: VulDB

Description
A vulnerability was found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. Affected is an unknown function of the file api/attendance_handler.php of the component JSON Endpoint. Performing a manipulation of the argument student_code results in missing authentication. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-125076
EUVD
EUVD-2026-120570

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
SourceCodester Smart Attendance System with QR Code Scanner 1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows unauthenticated attackers to forge attendance records in the Smart Attendance System with QR Code Scanner 1.0. The issue is in the api/attendance_handler.php file, which lacks authentication checks despite the main UI requiring login. Attackers can send a POST request with a student code to insert arbitrary attendance records without validation.

Detection Guidance

Check if the api/attendance_handler.php endpoint is accessible without authentication by sending a POST request with a student code. Use tools like curl to test: curl -X POST -d 'student_code=test' http://<target>/api/attendance_handler.php. If the endpoint accepts requests without credentials, the vulnerability may exist.

Impact Analysis

This vulnerability could allow attackers to manipulate attendance records, potentially falsifying student attendance data. It may also expose personal information by leaking student existence details, enabling enumeration of valid student codes and names.

Compliance Impact

This vulnerability could lead to unauthorized access and manipulation of attendance records, potentially violating data integrity and confidentiality requirements under GDPR and HIPAA. Exposure of student existence information may also breach GDPR's data minimization and security principles.

Mitigation Strategies

Immediately restrict access to the api/attendance_handler.php endpoint by implementing authentication checks. Update server configurations to block unauthenticated POST requests. Monitor logs for suspicious activity targeting this endpoint. Consider disabling the endpoint if not essential.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-125076. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...