CVE-2026-11510
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
SQL injection vulnerability in /admin/add_leave.php of CodeAstro Leave Management System 1.0 via the type_of_leave argument allows remote SQL injection.
Risk Assessment
An attacker can steal or modify leave data, compromising system integrity.
Recommendation
Use prepared statements or ORM for SQL queries in /admin/add_leave.php.
Other vulnerabilities in CodeAstro Leave Management System
See all- CVE-2026-8132High
A weakness has been identified in CodeAstro Leave Management System 1.0. Manipulation of the argument txt_username in the file /login.php leads to SQL injection vulnerability.
- CVE-2026-11509Medium
CodeAstro Leave Management System 1.0 has a SQL Injection vulnerability in the file /admin/search_staff_for_updation.php via manipulation of the Name argument. The attack can be performed remotely.
- CVE-2026-11508Medium
SQL injection vulnerability in /admin/search_staff_to_assign_pc.php of CodeAstro Leave Management System 1.0 via the Name argument allows remote SQL injection.
- CVE-2026-11507Medium
SQL injection vulnerability in /admin/delete_leave_type.php of CodeAstro Leave Management System 1.0 via the leave_type argument allows remote SQL injection.
- CVE-2026-11506Medium
SQL injection vulnerability in /admin/search_staff_for_deletion.php of CodeAstro Leave Management System 1.0 via the Name argument allows remote SQL injection.
Original NVD description (English source)
A security flaw has been discovered in CodeAstro Leave Management System 1.0. This affects an unknown part of the file /admin/add_leave.php. Performing a manipulation of the argument type_of_leave results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.