Is there a public PoC exploit available for CVE-2026-13525?

Yes, a public proof-of-concept exploit is available for CVE-2026-13525. Prioritise patching immediately. EPSS: 0.2%.

CodeAstro HRMS CVE-2026-13525

Q: What is the CVSS score of CVE-2026-13525?

CVE-2026-13525 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-40022 LOW

SQL Injection (CWE-89)

2026-06-29 VulDB

GHSA-xpc2-3p69-xq29

PHP SQLi Human Resource Management System Codeastro

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-reachable endpoint requires low-privilege auth (PR:L); time-based blind injection yields partial data read/write and can induce response delays (A:L).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 29, 2026 - 03:22 NVD

MEDIUM LOW

CVSS changed

Jun 29, 2026 - 03:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 29, 2026 - 02:46 vuln.today

DescriptionCVE.org

A vulnerability was detected in CodeAstro Human Resource Management System 1.0. This issue affects the function emselectByCode of the file application/models/Employee_model.php of the component Update_Earn_Leave Endpoint. The manipulation of the argument emid results in sql injection. The attack can be launched remotely. The exploit is now public and may be used.

AnalysisAI

SQL injection in CodeAstro Human Resource Management System 1.0 allows a low-privileged authenticated remote attacker to manipulate the emid parameter in the Update_Earn_Leave endpoint, triggering time-based blind SQL injection against the underlying database. The vulnerability resides in the emselectByCode function within application/models/Employee_model.php, where unsanitized input is passed directly into SQL query construction. A public proof-of-concept exploit is available on GitHub; no active exploitation has been confirmed by CISA KEV at time of analysis.

Technical ContextAI

The affected product is a PHP-based Human Resource Management System developed by CodeAstro, identified via CPE cpe:2.3:a:codeastro:human_resource_management_system:*:*:*:*:*:*:*:*. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), a classic SQL injection class where user-controlled input is interpolated into a SQL statement without parameterization or adequate sanitization. The specific vector is the emid argument handled by the emselectByCode model function in application/models/Employee_model.php, exposed through the Update_Earn_Leave HTTP endpoint. The POC on GitHub is explicitly described as a time-based blind SQL injection technique, meaning the attacker infers database content character-by-character via conditional time delays, consistent with the lack of direct error output to the HTTP response.

RemediationAI

No vendor-released patch has been identified at time of analysis - the CVE references point only to VulDB and a public GitHub POC, with no vendor advisory or patched release version confirmed. Organizations running CodeAstro Human Resource Management System 1.0 should immediately apply parameterized queries or prepared statements to the emselectByCode function in application/models/Employee_model.php, replacing any string interpolation of emid into SQL with bound parameters. As an interim compensating control, restrict access to the Update_Earn_Leave endpoint to trusted internal IP ranges using web server or WAF rules - this does not eliminate the vulnerability but significantly reduces the attack surface by preventing unapproved low-privilege accounts from reaching the endpoint remotely. Additionally, implement a Web Application Firewall rule to detect and block time-based SQL injection patterns (e.g., SLEEP(), WAITFOR DELAY, BENCHMARK() in query parameters). Monitor the vendor site at codeastro.com for patch availability. The VulDB disclosure at https://vuldb.com/vuln/374533 should be tracked for updates.