Is there a public PoC exploit available for CVE-2026-10286?

Yes, a public proof-of-concept exploit is available for CVE-2026-10286. Prioritise patching immediately. EPSS: 0.0%.

CodeAstro Payroll System CVE-2026-10286

Q: What is the CVSS score of CVE-2026-10286?

CVE-2026-10286 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33756 LOW

SQL Injection (CWE-89)

2026-06-01 VulDB

GHSA-9fq5-fpxf-7g86

PHP SQLi Payroll System

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 01, 2026 - 21:22 NVD

MEDIUM LOW

CVSS changed

Jun 01, 2026 - 21:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 01, 2026 - 20:53 vuln.today

DescriptionCVE.org

A vulnerability was found in CodeAstro Payroll System 1.0. This affects an unknown part of the file /home_employee.php. The manipulation of the argument emp_id results in sql injection. The attack may be performed from remote. The exploit has been made public and could be used.

AnalysisAI

SQL injection in CodeAstro Payroll System 1.0 allows remote authenticated attackers with low-privilege credentials to manipulate database queries via the emp_id parameter in /home_employee.php. Exploitation can result in unauthorized read access to confidential payroll records, limited data manipulation, and potential availability impact against the underlying database. Publicly available exploit code exists (referenced via GitHub), elevating real-world risk beyond the moderate CVSS score of 6.3; no public patch is available at time of analysis.

Technical ContextAI

CodeAstro Payroll System is a PHP-based web application (cpe:2.3:a:codeastro:payroll_system:*:*:*:*:*:*:*:*) used for employee payroll management. The vulnerability is rooted in CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), where the emp_id parameter passed to /home_employee.php is not properly sanitized or parameterized before being incorporated into a backend SQL query. This classic unsanitized input flaw allows an attacker to inject arbitrary SQL statements, potentially altering query logic to exfiltrate data, bypass access controls within the application, or corrupt records. The CVSS temporal modifier E:P confirms that proof-of-concept exploit code has been developed and published, consistent with the referenced GitHub issue.

RemediationAI

No vendor-released patch has been identified at time of analysis; the remediation level in the CVSS temporal vector is marked not defined (RL:X). Organizations running CodeAstro Payroll System 1.0 should monitor https://codeastro.com/ and the VulDB entry at https://vuldb.com/cve/CVE-2026-10286 for patch availability. In the interim, specific compensating controls include: restricting access to /home_employee.php at the web server or WAF layer to only trusted internal IP ranges, which reduces remote attack surface at the cost of limiting remote workforce access; deploying a Web Application Firewall rule to detect and block SQL injection patterns in the emp_id parameter, noting that WAF bypass is possible with obfuscation techniques; enforcing least-privilege database credentials for the application's DB connection so that even a successful injection cannot access tables beyond the payroll schema; and auditing existing application logs for anomalous emp_id values (e.g., SQL metacharacters such as single quotes, UNION, or SLEEP keywords) to detect potential prior exploitation.