CVE-2026-15523
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A SQL injection vulnerability has been found in CodeAstro Simple Online Leave Management System 1.0 in the file /SimpleOnlineLeave/admin/dashboard.php via the Name argument. The attack can be performed remotely and the exploit is publicly available.
Risk Assessment
The organization is at risk of unauthorized database access, potentially leading to data breaches, modification, or deletion of sensitive information.
Recommendation
Immediately update the system to the latest version or apply a security patch, and implement input validation and parameterized SQL queries.
Other vulnerabilities in CodeAstro Simple Online Leave Management System
See all- CVE-2026-15559Medium
A SQL injection vulnerability was found in CodeAstro Simple Online Leave Management System 1.0 in the file /SimpleOnlineLeave/admin/accept.php. An attacker can remotely manipulate the appid argument, leading to SQL injection. The exploit is publicly available.
- CVE-2026-15558Medium
A SQL injection vulnerability has been found in CodeAstro Simple Online Leave Management System 1.0 in the file /SimpleOnlineLeave/admin/deletemp.php. Manipulation of the ID argument allows remote SQL injection. The exploit has been publicly disclosed.
- CVE-2026-15134High
A SQL injection vulnerability was found in CodeAstro Simple Online Leave Management System 1.0 in the file /SimpleOnlineLeave/index.php. An attacker can remotely manipulate the email argument, leading to SQL injection. The exploit has been publicly disclosed.
Original NVD description (English source)
A weakness has been identified in CodeAstro Simple Online Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /SimpleOnlineLeave/admin/dashboard.php. This manipulation of the argument Name causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.