CVE-2026-11509
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
CodeAstro Leave Management System 1.0 has a SQL Injection vulnerability in the file /admin/search_staff_for_updation.php via manipulation of the Name argument. The attack can be performed remotely.
Risk Assessment
A remote attacker can inject SQL queries, allowing reading, modification, or deletion of database data, including credentials and sensitive information.
Recommendation
Update CodeAstro Leave Management System to the latest version. If unavailable, use parameterized queries or temporarily disable the application.
Other vulnerabilities in CodeAstro Leave Management System
See all- CVE-2026-8132High
A weakness has been identified in CodeAstro Leave Management System 1.0. Manipulation of the argument txt_username in the file /login.php leads to SQL injection vulnerability.
- CVE-2026-11510Medium
SQL injection vulnerability in /admin/add_leave.php of CodeAstro Leave Management System 1.0 via the type_of_leave argument allows remote SQL injection.
- CVE-2026-11508Medium
SQL injection vulnerability in /admin/search_staff_to_assign_pc.php of CodeAstro Leave Management System 1.0 via the Name argument allows remote SQL injection.
- CVE-2026-11507Medium
SQL injection vulnerability in /admin/delete_leave_type.php of CodeAstro Leave Management System 1.0 via the leave_type argument allows remote SQL injection.
- CVE-2026-11506Medium
SQL injection vulnerability in /admin/search_staff_for_deletion.php of CodeAstro Leave Management System 1.0 via the Name argument allows remote SQL injection.
Original NVD description (English source)
A vulnerability was identified in CodeAstro Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/search_staff_for_updation.php. Such manipulation of the argument Name leads to sql injection. The attack may be performed from remote.