CVE-2026-15558
MediumCVSS 6.3Summary
A SQL injection vulnerability has been found in CodeAstro Simple Online Leave Management System 1.0 in the file /SimpleOnlineLeave/admin/deletemp.php. Manipulation of the ID argument allows remote SQL injection. The exploit has been publicly disclosed.
Risk Assessment
An attacker can remotely extract, modify, or delete database records, compromising the confidentiality and integrity of the system.
Recommendation
Immediately update the system to the latest version or apply a security patch to prevent SQL injection, e.g., by using parameterized queries.
Other vulnerabilities in CodeAstro Simple Online Leave Management System
See all- CVE-2026-15559Medium
A SQL injection vulnerability was found in CodeAstro Simple Online Leave Management System 1.0 in the file /SimpleOnlineLeave/admin/accept.php. An attacker can remotely manipulate the appid argument, leading to SQL injection. The exploit is publicly available.
- CVE-2026-15523Medium
A SQL injection vulnerability has been found in CodeAstro Simple Online Leave Management System 1.0 in the file /SimpleOnlineLeave/admin/dashboard.php via the Name argument. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-15134High
A SQL injection vulnerability was found in CodeAstro Simple Online Leave Management System 1.0 in the file /SimpleOnlineLeave/index.php. An attacker can remotely manipulate the email argument, leading to SQL injection. The exploit has been publicly disclosed.
Original NVD description (English source)
A security vulnerability has been detected in CodeAstro Simple Online Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /SimpleOnlineLeave/admin/deletemp.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.