CVE-2026-13537
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
A cross-site request forgery (CSRF) vulnerability was found in CodeAstro Human Resource Management System 1.0. An unknown function allows remote attackers to perform unauthorized actions on behalf of an authenticated user. The exploit has been made public and could be used.
Risk Assessment
A CSRF attack could allow unauthorized operations in the HR system, such as modifying employee data or changing configuration, threatening data integrity and confidentiality.
Recommendation
Immediately update the system to the latest version or apply a vendor patch. In the meantime, implement CSRF protection mechanisms such as anti-CSRF tokens and Origin header checking.
Other vulnerabilities in CodeAstro Human Resource Management System
See all- CVE-2026-13535Medium
A SQL injection vulnerability was found in CodeAstro Human Resource Management System 1.0 in the GetFileInfo function of Employee_model.php. Manipulating the ID argument in the view endpoint allows remote attack. The exploit has been published and may be used.
- CVE-2026-13525Medium
A SQL injection vulnerability was found in CodeAstro Human Resource Management System 1.0 in the emselectByCode function of Employee_model.php. The attack manipulates the emid argument in the Update_Earn_Leave endpoint. It can be exploited remotely and the exploit is publicly available.
- CVE-2026-11491Low
A stored XSS vulnerability was found in CodeAstro Human Resource Management System 1.0 in the Notice Board Management function. Manipulating the 'Notice Title' argument via POST with JavaScript code leads to script execution in the victim's browser.
Original NVD description (English source)
A vulnerability was found in CodeAstro Human Resource Management System 1.0. Impacted is an unknown function. The manipulation results in cross-site request forgery. The attack may be launched remotely. The exploit has been made public and could be used.