Is there a public PoC exploit available for CVE-2026-11508?

Yes, a public proof-of-concept exploit is available for CVE-2026-11508. Prioritise patching immediately. EPSS: 0.0%.

CodeAstro Leave Management System CVE-2026-11508

Q: What is the CVSS score of CVE-2026-11508?

CVE-2026-11508 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35045 LOW

SQL Injection (CWE-89)

2026-06-08 VulDB

GHSA-pxpv-x94f-9r98

PHP SQLi Leave Management System

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:46 vuln.today

Severity Changed

Jun 08, 2026 - 12:22 NVD

MEDIUM LOW

CVSS changed

Jun 08, 2026 - 12:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability was determined in CodeAstro Leave Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/search_staff_to_assign_pc.php. This manipulation of the argument Name causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

SQL injection in CodeAstro Leave Management System 1.0 allows low-privileged authenticated remote attackers to manipulate database queries via the Name parameter in the admin endpoint /admin/search_staff_to_assign_pc.php. Per the CVSS 4.0 vector, impact is limited to low confidentiality, integrity, and availability on the vulnerable system (VC:L/VI:L/VA:L) with no scope change to subsequent systems. Publicly available exploit code exists via a GitHub issue, though no active exploitation is confirmed in CISA KEV, and no vendor-released patch has been identified at time of analysis.

Technical ContextAI

The affected component is a PHP-based admin search endpoint within CodeAstro's Leave Management System 1.0, identified by CPE cpe:2.3:a:codeastro:leave_management_system:*:*:*:*:*:*:*:*. The root cause class is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), which indicates the Name parameter passed to /admin/search_staff_to_assign_pc.php is concatenated directly into a backend SQL query without sanitization or parameterized binding. This permits an attacker to inject arbitrary SQL syntax, potentially enumerating, reading, or modifying records accessible to the application's database account. The PHP tag confirms server-side scripting handles query construction, and the SQLi tag corroborates the injection class. The wildcard version in the CPE string means NVD has not bounded the range beyond the reported 1.0 release.

RemediationAI

No vendor-released patch has been identified at time of analysis - patch availability should be verified directly with CodeAstro at https://codeastro.com/. As an immediate compensating control, restrict access to /admin/search_staff_to_assign_pc.php to trusted internal IP ranges via web server ACLs or a perimeter firewall; this eliminates remote exploitation but does not address insider threat. Deploy a web application firewall (WAF) rule blocking SQL metacharacters (single quotes, comment sequences, UNION keywords) in the Name parameter - effective against unsophisticated attacks but bypassable by encoded or obfuscated payloads. Limit the database user account used by the application to the minimum required permissions (e.g., SELECT-only on relevant tables) to constrain the blast radius of any successful injection. For a permanent fix, the Name parameter must be bound via parameterized queries or prepared statements in the PHP source; string escaping alone is insufficient. VulDB tracking: https://vuldb.com/cve/CVE-2026-11508.