CodeAstro Leave Management CVE-2026-11509

Q: What is the CVSS score of CVE-2026-11509?

CVE-2026-11509 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35048 MEDIUM

SQL Injection (CWE-89)

2026-06-08 VulDB

GHSA-rcqr-qj5x-xvqj

PHP SQLi

5.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:45 vuln.today

CVSS changed

Jun 08, 2026 - 12:22 NVD

6.3 (MEDIUM) 5.3 (MEDIUM)

DescriptionCVE.org

A vulnerability was identified in CodeAstro Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/search_staff_for_updation.php. Such manipulation of the argument Name leads to sql injection. The attack may be performed from remote.

AnalysisAI

SQL injection in CodeAstro Leave Management System 1.0 allows authenticated remote attackers to manipulate database queries via the Name parameter in /admin/search_staff_for_updation.php. The vulnerability enables read, write, and denial-of-service impact against the underlying database with low complexity and no user interaction required. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

CodeAstro Leave Management System 1.0 is a PHP-based web application (tagged PHP, SQLi per VulDB). The affected endpoint /admin/search_staff_for_updation.php fails to properly sanitize the 'Name' parameter before incorporating it into SQL queries, constituting a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The CPE string cpe:2.3:a:codeastro:leave_management_system:*:*:*:*:*:*:*:* confirms the affected product is CodeAstro's Leave Management System; the wildcard version component suggests no patched release has been formally catalogued. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N confirms network-reachable exploitation with low attack complexity, no attack prerequisites beyond authenticated access, and no user interaction.

RemediationAI

No vendor-released patch has been identified at time of analysis; the CPE wildcard and absence of a vendor advisory URL suggest no patched release is currently available. Organizations using CodeAstro Leave Management System 1.0 should apply parameterized queries or prepared statements to the Name parameter in /admin/search_staff_for_updation.php as the definitive fix once a patch is released. In the interim, restrict access to the /admin/ directory to trusted IP ranges or internal networks only, reducing exposure of the vulnerable endpoint - note this does not eliminate the vulnerability but limits who can reach it. Web application firewall (WAF) rules targeting common SQL injection payloads (single quotes, UNION SELECT, comment sequences) can provide partial compensating control but may be bypassed by advanced encoding. Monitor database logs for anomalous query patterns originating from the admin search function. Track codeastro.com and VulDB entry vuldb.com/vuln/369129 for patch availability.