Is there a public PoC exploit available for CVE-2026-11558?

Yes, a public proof-of-concept exploit is available for CVE-2026-11558. Prioritise patching immediately. EPSS: 0.0%.

CodeAstro Payroll System CVE-2026-11558

Q: What is the CVSS score of CVE-2026-11558?

CVE-2026-11558 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35185 LOW

SQL Injection (CWE-89)

2026-06-08 VulDB

PHP SQLi Payroll System

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 19:29 vuln.today

Severity Changed

Jun 08, 2026 - 19:22 NVD

MEDIUM LOW

CVSS changed

Jun 08, 2026 - 19:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A security vulnerability has been detected in CodeAstro Payroll System 1.0. The impacted element is an unknown function of the file /home_salary.php. The manipulation of the argument rate/salary_rate leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

SQL injection in CodeAstro Payroll System 1.0 exposes payroll data to manipulation by authenticated low-privilege users via unsanitized input in the salary calculation endpoint. The vulnerability affects the rate and salary_rate parameters of /home_salary.php, where attacker-controlled values are passed directly into SQL queries without sanitization. Publicly available exploit code exists per GitHub references, though the vulnerability is not listed in the CISA KEV catalog and carries a CVSS 4.0 base score of only 2.1, reflecting constrained real-world impact due to authentication requirements and limited CIA impact ratings.

Technical ContextAI

CodeAstro Payroll System is a PHP-based payroll management web application (CPE: cpe:2.3:a:codeastro:payroll_system:*:*:*:*:*:*:*:*). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), a classic SQL injection class where user-supplied HTTP parameters - specifically rate and salary_rate submitted to /home_salary.php - are incorporated into SQL queries without parameterization or adequate input validation. This allows an authenticated attacker to alter query logic, potentially reading, modifying, or deleting database records accessible to the application's database user. The application appears to be a small, self-contained PHP project targeting educational or small-business deployments, consistent with the CodeAstro product portfolio.

RemediationAI

No vendor-released patch has been identified at the time of analysis; the CodeAstro website (https://codeastro.com/) does not publish a security advisory for this CVE. Operators running CodeAstro Payroll System should immediately apply parameterized queries or prepared statements in the /home_salary.php file for the rate and salary_rate parameters, which is the definitive developer-side fix. As a compensating control, restrict access to the application exclusively to trusted, authenticated users on an internal network segment and disable external-facing exposure - this limits the attack surface to insider threats rather than external actors. A web application firewall (WAF) rule filtering SQL metacharacters (single quotes, UNION, SELECT keywords) in POST/GET parameters can reduce opportunistic exploitation risk, though WAF bypass techniques are well-documented and this should not be the sole mitigation. Audit database user privileges granted to the application's database connection account and apply the principle of least privilege - if the account only requires SELECT on salary tables, revoke INSERT/UPDATE/DELETE to limit the blast radius of a successful injection.