Is there a public PoC exploit available for CVE-2026-11559?

Yes, a public proof-of-concept exploit is available for CVE-2026-11559. Prioritise patching immediately. EPSS: 0.0%.

CodeAstro Payroll System CVE-2026-11559

Q: What is the CVSS score of CVE-2026-11559?

CVE-2026-11559 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35189 LOW

SQL Injection (CWE-89)

2026-06-08 VulDB

PHP SQLi Payroll System

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 19:29 vuln.today

Severity Changed

Jun 08, 2026 - 19:22 NVD

MEDIUM LOW

CVSS changed

Jun 08, 2026 - 19:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability was detected in CodeAstro Payroll System 1.0. This affects an unknown function of the file /view_account.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.

AnalysisAI

SQL injection in CodeAstro Payroll System 1.0 exposes database records to manipulation via the ID parameter in /view_account.php, allowing a low-privileged authenticated remote attacker to read, alter, or partially disrupt payroll data. A public proof-of-concept exploit is available via GitHub, as reported by VulDB. Despite network accessibility and public PoC, the CVSS 4.0 score of 2.1 reflects constrained impact - limited to the vulnerable component with no lateral scope - and a mandatory low-privilege authentication prerequisite that tempers broad exploitation risk.

Technical ContextAI

CodeAstro Payroll System is a PHP-based web application used for employee payroll management, identified via CPE cpe:2.3:a:codeastro:payroll_system:*:*:*:*:*:*:*:*. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), a classic SQL injection flaw in which user-supplied input - specifically the 'ID' GET or POST parameter passed to /view_account.php - is concatenated directly into a SQL query without parameterization or adequate sanitization. This allows an attacker to alter the query's logic, extract data beyond the intended result set, or perform write operations depending on database user privileges. The vulnerability class is well-understood, and exploitation tooling (e.g., sqlmap) trivially automates such attacks once an injectable endpoint is identified.

RemediationAI

No vendor-released patch has been identified at time of analysis. The primary recommended fix is to replace direct SQL string concatenation in /view_account.php with parameterized queries or prepared statements using PHP's PDO or MySQLi extensions, which eliminates the injection root cause entirely. Until a code-level fix is applied, the following compensating controls are actionable: restrict access to /view_account.php at the web server or application firewall layer to only trusted internal IP ranges - this directly limits the attack surface but may disrupt legitimate remote users; deploy a Web Application Firewall (WAF) with SQLi detection rules targeting the ID parameter, noting that WAF bypass techniques exist and this should not substitute for code-level remediation; enforce the principle of least privilege on the database account used by the application so that injected queries cannot perform DROP, INSERT, or cross-schema operations, reducing but not eliminating impact. Reference VulDB tracking at https://vuldb.com/vuln/369169 and the public PoC at https://github.com/Andelstander/cve/issues/1 for technical reproduction details.