A script in the administrative dashboard of CodeAstro Simple Online Leave Management System permits an attacker to send a specially crafted "Name" argument that is concatenated directly into an SQL statement without proper escaping or parameterization, resulting in a classic SQL injection. The flaw is categorized as CWE-74 and CWE-89. If successfully exploited, the attacker could read, modify, or delete sensitive employee and leave records, jeopardizing confidentiality and integrity of the data stored in the system.

The affected product is CodeAstro Simple Online Leave Management System version 1.0; no other product versions are listed as impacted according to the CVE data.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a very low likelihood of exploitation at this time. The vulnerability is not listed in CISA KEV. The attack vector is remote, targeting the /admin/dashboard.php endpoint, meaning that an unauthenticated or minimally privileged attacker who can reach this URL over the network could achieve data compromise. Although the overall risk is not critical, the potential for unauthorized data access warrants timely mitigation.