Sourcecodester Human Resource Management System 1.0 is vulnerable to SQL Injection via the 'leave' parameter.
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')