CVE-2026-11507

MediumCVSS 6.3

Published: 08/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

SQL injection vulnerability in /admin/delete_leave_type.php of CodeAstro Leave Management System 1.0 via the leave_type argument allows remote SQL injection.

Risk Assessment

An attacker can delete or modify leave types, disrupting system operation.

Recommendation

Use prepared statements for the leave_type argument in /admin/delete_leave_type.php.

Other vulnerabilities in CodeAstro Leave Management System

See all

CVE-2026-8132High
A weakness has been identified in CodeAstro Leave Management System 1.0. Manipulation of the argument txt_username in the file /login.php leads to SQL injection vulnerability.
CVE-2026-11510Medium
SQL injection vulnerability in /admin/add_leave.php of CodeAstro Leave Management System 1.0 via the type_of_leave argument allows remote SQL injection.
CVE-2026-11509Medium
CodeAstro Leave Management System 1.0 has a SQL Injection vulnerability in the file /admin/search_staff_for_updation.php via manipulation of the Name argument. The attack can be performed remotely.
CVE-2026-11508Medium
SQL injection vulnerability in /admin/search_staff_to_assign_pc.php of CodeAstro Leave Management System 1.0 via the Name argument allows remote SQL injection.
CVE-2026-11506Medium
SQL injection vulnerability in /admin/search_staff_for_deletion.php of CodeAstro Leave Management System 1.0 via the Name argument allows remote SQL injection.

Original NVD description (English source)

A vulnerability was found in CodeAstro Leave Management System 1.0. Affected is an unknown function of the file /admin/delete_leave_type.php. The manipulation of the argument leave_type results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used.