Is there a public PoC exploit available for CVE-2026-11506?

Yes, a public proof-of-concept exploit is available for CVE-2026-11506. Prioritise patching immediately. EPSS: 0.0%.

Leave Management System CVE-2026-11506

Q: What is the CVSS score of CVE-2026-11506?

CVE-2026-11506 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35042 LOW

SQL Injection (CWE-89)

2026-06-08 VulDB

GHSA-9g85-fr2q-5cpm

PHP SQLi Leave Management System

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:46 vuln.today

Severity Changed

Jun 08, 2026 - 12:22 NVD

MEDIUM LOW

CVSS changed

Jun 08, 2026 - 12:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability has been found in CodeAstro Leave Management System 1.0. This impacts an unknown function of the file /admin/search_staff_for_deletion.php. The manipulation of the argument Name leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in CodeAstro Leave Management System 1.0 allows remote authenticated attackers to manipulate database queries via the Name parameter in /admin/search_staff_for_deletion.php. The vulnerability is a classic CWE-89 unsanitized input flaw in a PHP-based web application, enabling read, write, and limited availability impact against the underlying database. Publicly available exploit code exists per VulDB disclosure; no KEV listing indicates opportunistic rather than targeted exploitation at this time.

Technical ContextAI

CodeAstro Leave Management System 1.0 is a PHP web application (CPE: cpe:2.3:a:codeastro:leave_management_system:*:*:*:*:*:*:*:*) used for HR staff leave tracking. The vulnerable endpoint /admin/search_staff_for_deletion.php accepts a Name parameter that is passed unsanitized into a SQL query, constituting a CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) weakness. This class of flaw typically arises from direct string concatenation of user input into SQL statements without prepared statements or parameterized queries. The PHP/MySQL stack common to CodeAstro applications makes this a textbook SQLi scenario where an attacker can inject UNION-based, boolean-based, or time-based payloads.

RemediationAI

No vendor-released patch has been identified at time of analysis. The vendor site (https://codeastro.com/) should be monitored for an updated release addressing CVE-2026-11506. As an immediate compensating control, restrict access to /admin/search_staff_for_deletion.php via web server configuration (e.g., IP allowlist or HTTP authentication layer) to reduce the attacker pool - note this does not fix the underlying flaw but limits exposure. Implement a Web Application Firewall (WAF) rule to detect and block SQL metacharacter patterns in the Name parameter; be aware this may cause false positives on legitimate staff names containing apostrophes. Developers should remediate by replacing string-concatenated SQL queries with PDO prepared statements or MySQLi parameterized queries in the affected file. Until patched, audit database user privileges to ensure the application DB account has minimal permissions (no DROP, FILE, or GRANT privileges) to limit the blast radius of successful exploitation.