Is there a public PoC exploit available for CVE-2026-13535?

Yes, a public proof-of-concept exploit is available for CVE-2026-13535. Prioritise patching immediately. EPSS: 0.2%.

CodeAstro HRMS CVE-2026-13535

Q: What is the CVSS score of CVE-2026-13535?

CVE-2026-13535 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-40032 LOW

SQL Injection (CWE-89)

2026-06-29 VulDB

GHSA-c3cr-5fg3-j222

PHP SQLi Human Resource Management System Codeastro

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-reachable SQLi requires low-privilege authentication (PR:L); no scope change and limited CIA impact align with constrained HRMS database exposure.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 29, 2026 - 06:22 NVD

MEDIUM LOW

CVSS changed

Jun 29, 2026 - 06:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 29, 2026 - 05:47 vuln.today

DescriptionCVE.org

A flaw has been found in CodeAstro Human Resource Management System 1.0. This vulnerability affects the function GetFileInfo of the file hrsystem/application/models/Employee_model.php of the component View Endpoint. Executing a manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used.

AnalysisAI

SQL injection in CodeAstro Human Resource Management System 1.0 allows low-privileged remote attackers to manipulate database queries via the ID argument passed to the GetFileInfo function within the View Endpoint. The vulnerability resides in hrsystem/application/models/Employee_model.php and can result in unauthorized read and write access to the underlying database. A public exploit has been published on GitHub, elevating practical risk despite the authentication requirement and moderate CVSS 4.0 score of 5.3.

Technical ContextAI

The affected product is a PHP-based Human Resource Management System developed by CodeAstro, identified via CPE cpe:2.3:a:codeastro:human_resource_management_system:*:*:*:*:*:*:*:*. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning the application fails to sanitize or parameterize the ID argument before incorporating it into a database query inside the GetFileInfo function of Employee_model.php. This is a classic unsanitized user-controlled input reaching an SQL execution context - a fundamental PHP/MySQL pattern flaw where prepared statements or ORM-level escaping are absent for this code path.

RemediationAI

No vendor-released patch or fixed version has been identified at time of analysis. The primary remediation is to apply parameterized queries or prepared statements to the GetFileInfo function in hrsystem/application/models/Employee_model.php, replacing direct string interpolation of the ID parameter. As an immediate compensating control, restrict access to the View Endpoint to trusted internal networks or VPN only, reducing the network-accessible attack surface. Deploying a Web Application Firewall (WAF) with SQL injection signatures can detect and block exploit attempts against this endpoint, though WAF bypass is possible with obfuscation. Input validation enforcing integer-only values for the ID parameter would also reduce exploitability with minimal functional trade-off. Operators should monitor authentication logs for unusual low-privilege account activity against the employee view functionality. References: VulDB entry at https://vuldb.com/vuln/374543 and public exploit repository at https://github.com/ashikmd0507/CVE/tree/main/SQL%20Injection%20via%20GetFileInfo%20Function.