CVE-2026-15134
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A SQL injection vulnerability was found in CodeAstro Simple Online Leave Management System 1.0 in the file /SimpleOnlineLeave/index.php. An attacker can remotely manipulate the email argument, leading to SQL injection. The exploit has been publicly disclosed.
Risk Assessment
The risk includes unauthorized database access, sensitive data leakage, and potential remote takeover of the system by an attacker.
Recommendation
Immediately update the system to the latest version or apply a security patch. Additionally, validate and sanitize all input data, especially the email argument.
Other vulnerabilities in CodeAstro Simple Online Leave Management System
See all- CVE-2026-15559Medium
A SQL injection vulnerability was found in CodeAstro Simple Online Leave Management System 1.0 in the file /SimpleOnlineLeave/admin/accept.php. An attacker can remotely manipulate the appid argument, leading to SQL injection. The exploit is publicly available.
- CVE-2026-15558Medium
A SQL injection vulnerability has been found in CodeAstro Simple Online Leave Management System 1.0 in the file /SimpleOnlineLeave/admin/deletemp.php. Manipulation of the ID argument allows remote SQL injection. The exploit has been publicly disclosed.
- CVE-2026-15523Medium
A SQL injection vulnerability has been found in CodeAstro Simple Online Leave Management System 1.0 in the file /SimpleOnlineLeave/admin/dashboard.php via the Name argument. The attack can be performed remotely and the exploit is publicly available.
Original NVD description (English source)
A vulnerability was determined in CodeAstro Simple Online Leave Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /SimpleOnlineLeave/index.php. Executing a manipulation of the argument email can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.