CVE-2026-15523

CodeAstro Simple Online Leave Management System dashboard.php sql injection

View on CVE.org
Published Jul 13, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A weakness has been identified in CodeAstro Simple Online Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /SimpleOnlineLeave/admin/dashboard.php. This manipulation of the argument Name causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

Analysis

AI-generated

Technical impact

A script in the administrative dashboard of CodeAstro Simple Online Leave Management System permits an attacker to send a specially crafted "Name" argument that is concatenated directly into an SQL statement without proper escaping or parameterization, resulting in a classic SQL injection. The flaw is categorized as CWE-74 and CWE-89. If successfully exploited, the attacker could read, modify, or delete sensitive employee and leave records, jeopardizing confidentiality and integrity of the data stored in the system.

Affected Systems

The affected product is CodeAstro Simple Online Leave Management System version 1.0; no other product versions are listed as impacted according to the CVE data.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a very low likelihood of exploitation at this time. The vulnerability is not listed in CISA KEV. The attack vector is remote, targeting the /admin/dashboard.php endpoint, meaning that an unauthenticated or minimally privileged attacker who can reach this URL over the network could achieve data compromise. Although the overall risk is not critical, the potential for unauthorized data access warrants timely mitigation.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check for and apply any vendor‑provided patch for dashboard.php in CodeAstro Simple Online Leave Management System.
  • Update the code to use prepared statements or otherwise validate and escape the "Name" input to prevent concatenation of untrusted data into SQL queries.
  • Restrict access to /admin/dashboard.php so that only authenticated and authorized administrators can reach it, and consider network segmentation or firewall rules to limit exposure.

Generated by OpenCVE AI on August 1, 2026 at 10:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A weakness has been identified in CodeAstro Simple Online Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /SimpleOnlineLeave/admin/dashboard.php. This manipulation of the argument Name causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Title CodeAstro Simple Online Leave Management System dashboard.php sql injection
First Time appeared Codeastro
Codeastro simple Online Leave Management System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:codeastro:simple_online_leave_management_system:*:*:*:*:*:*:*:*
Vendors & Products Codeastro
Codeastro simple Online Leave Management System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Jul 14, 2026, 2:51 PM
Reserved
Jul 12, 2026, 11:38 AM

View source JSON

Updated
Jul 14, 2026, 2:51 PM

JSON

Status
Deferred
Published
Jul 13, 2026, 3:16 AM
Modified
Oct 24, 2026, 10:10 PM

View source JSON

No data.

Updated
Aug 1, 2026, 11:00 AM

JSON