CVE-2026-11506
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
SQL injection vulnerability in /admin/search_staff_for_deletion.php of CodeAstro Leave Management System 1.0 via the Name argument allows remote SQL injection.
Risk Assessment
Remote deletion of employees from the database is possible, leading to data loss.
Recommendation
Implement parameterized queries for the Name argument in this file.
Other vulnerabilities in CodeAstro Leave Management System
See all- CVE-2026-8132High
A weakness has been identified in CodeAstro Leave Management System 1.0. Manipulation of the argument txt_username in the file /login.php leads to SQL injection vulnerability.
- CVE-2026-11510Medium
SQL injection vulnerability in /admin/add_leave.php of CodeAstro Leave Management System 1.0 via the type_of_leave argument allows remote SQL injection.
- CVE-2026-11509Medium
CodeAstro Leave Management System 1.0 has a SQL Injection vulnerability in the file /admin/search_staff_for_updation.php via manipulation of the Name argument. The attack can be performed remotely.
- CVE-2026-11508Medium
SQL injection vulnerability in /admin/search_staff_to_assign_pc.php of CodeAstro Leave Management System 1.0 via the Name argument allows remote SQL injection.
- CVE-2026-11507Medium
SQL injection vulnerability in /admin/delete_leave_type.php of CodeAstro Leave Management System 1.0 via the leave_type argument allows remote SQL injection.
Original NVD description (English source)
A vulnerability has been found in CodeAstro Leave Management System 1.0. This impacts an unknown function of the file /admin/search_staff_for_deletion.php. The manipulation of the argument Name leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.