CVE-2026-15559
MediumCVSS 6.3Summary
A SQL injection vulnerability was found in CodeAstro Simple Online Leave Management System 1.0 in the file /SimpleOnlineLeave/admin/accept.php. An attacker can remotely manipulate the appid argument, leading to SQL injection. The exploit is publicly available.
Risk Assessment
The risk includes unauthorized database access, sensitive data leakage, and potential system takeover.
Recommendation
Immediately update the system to the latest version or apply a security patch. Additionally, validate and sanitize all input data.
Other vulnerabilities in CodeAstro Simple Online Leave Management System
See all- CVE-2026-15558Medium
A SQL injection vulnerability has been found in CodeAstro Simple Online Leave Management System 1.0 in the file /SimpleOnlineLeave/admin/deletemp.php. Manipulation of the ID argument allows remote SQL injection. The exploit has been publicly disclosed.
- CVE-2026-15523Medium
A SQL injection vulnerability has been found in CodeAstro Simple Online Leave Management System 1.0 in the file /SimpleOnlineLeave/admin/dashboard.php via the Name argument. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-15134High
A SQL injection vulnerability was found in CodeAstro Simple Online Leave Management System 1.0 in the file /SimpleOnlineLeave/index.php. An attacker can remotely manipulate the email argument, leading to SQL injection. The exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability was detected in CodeAstro Simple Online Leave Management System 1.0. This affects an unknown part of the file /SimpleOnlineLeave/admin/accept.php of the component POST Handler. Performing a manipulation of the argument appid results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.