CVE-2026-11508
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
SQL injection vulnerability in /admin/search_staff_to_assign_pc.php of CodeAstro Leave Management System 1.0 via the Name argument allows remote SQL injection.
Risk Assessment
Remote database access and theft of employee personal data is possible.
Recommendation
Apply input filtering and parameterized queries for the Name argument in this file.
Other vulnerabilities in CodeAstro Leave Management System
See all- CVE-2026-8132High
A weakness has been identified in CodeAstro Leave Management System 1.0. Manipulation of the argument txt_username in the file /login.php leads to SQL injection vulnerability.
- CVE-2026-11510Medium
SQL injection vulnerability in /admin/add_leave.php of CodeAstro Leave Management System 1.0 via the type_of_leave argument allows remote SQL injection.
- CVE-2026-11509Medium
CodeAstro Leave Management System 1.0 has a SQL Injection vulnerability in the file /admin/search_staff_for_updation.php via manipulation of the Name argument. The attack can be performed remotely.
- CVE-2026-11507Medium
SQL injection vulnerability in /admin/delete_leave_type.php of CodeAstro Leave Management System 1.0 via the leave_type argument allows remote SQL injection.
- CVE-2026-11506Medium
SQL injection vulnerability in /admin/search_staff_for_deletion.php of CodeAstro Leave Management System 1.0 via the Name argument allows remote SQL injection.
Original NVD description (English source)
A vulnerability was determined in CodeAstro Leave Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/search_staff_to_assign_pc.php. This manipulation of the argument Name causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.