Is there a public PoC exploit available for CVE-2026-11510?

Yes, a public proof-of-concept exploit is available for CVE-2026-11510. Prioritise patching immediately. EPSS: 0.0%.

Leave Management System CVE-2026-11510

Q: What is the CVSS score of CVE-2026-11510?

CVE-2026-11510 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35050 LOW

SQL Injection (CWE-89)

2026-06-08 VulDB

GHSA-wx9h-mw6h-4m49

PHP SQLi Leave Management System

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:45 vuln.today

Severity Changed

Jun 08, 2026 - 12:22 NVD

MEDIUM LOW

CVSS changed

Jun 08, 2026 - 12:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A security flaw has been discovered in CodeAstro Leave Management System 1.0. This affects an unknown part of the file /admin/add_leave.php. Performing a manipulation of the argument type_of_leave results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in CodeAstro Leave Management System 1.0 exposes the application's database to remote authenticated attackers via the type_of_leave parameter in /admin/add_leave.php. The vulnerability (CWE-89) allows manipulation of backend SQL queries, potentially enabling data extraction, modification, or destruction. A publicly available exploit exists per VulDB report and a referenced GitHub proof-of-concept, elevating practical risk despite the low CVSS 4.0 base score of 2.1.

Technical ContextAI

CodeAstro Leave Management System 1.0 is a PHP-based web application (per the 'PHP, SQLi' tags and CPE cpe:2.3:a:codeastro:leave_management_system:*:*:*:*:*:*:*:*). The vulnerability resides in the admin panel file /admin/add_leave.php, where the type_of_leave POST/GET argument is passed unsanitized into a SQL query - a classic CWE-89 (Improper Neutralization of Special Elements used in a SQL Command) defect. This class of vulnerability typically arises from the absence of prepared statements or parameterized queries in PHP database interactions (e.g., raw mysqli_query or mysql_query calls with string concatenation). The sink is within the admin interface, implying the application does not validate or escape user-supplied input before constructing the SQL statement.

RemediationAI

No vendor-released patch has been identified at time of analysis. Operators should contact the vendor at https://codeastro.com/ to request a patched release or review the source for a fix commit. As an immediate compensating control, restrict access to /admin/add_leave.php by enforcing IP allowlisting at the web server or firewall layer - this reduces the attack surface to known administrative source addresses, though it does not eliminate the vulnerability. Additionally, implement a Web Application Firewall (WAF) rule to detect and block SQL injection payloads in the type_of_leave parameter; note this introduces a maintenance burden and may cause false positives on legitimate leave type names containing SQL keywords. Developers with access to the source can apply a code-level fix by replacing raw query string concatenation in /admin/add_leave.php with PHP PDO prepared statements or mysqli_prepare() - this is the only definitive remediation. The exploit reference is available at https://github.com/Andelstander/cve/issues/3 and the VulDB entry at https://vuldb.com/vuln/369130.