Skip to main content

CodeAstro HRMS CVE-2026-13537

| EUVDEUVD-2026-40035 LOW
Cross-Site Request Forgery (CSRF) (CWE-352)
2026-06-29 VulDB GHSA-c7qf-p72p-2xj2
CSRF Human Resource Management System
2.1
CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY
2.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.3 MEDIUM

Network-reachable CSRF with no attacker privileges; mandatory user interaction (UI:R); integrity-only impact limited to department data deletion.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

3
Severity Changed
Jun 29, 2026 - 06:22 NVD
MEDIUM LOW
CVSS changed
Jun 29, 2026 - 06:22 NVD
5.3 (MEDIUM) 2.1 (LOW)
Analysis Generated
Jun 29, 2026 - 05:48 vuln.today

DescriptionCVE.org

A vulnerability was found in CodeAstro Human Resource Management System 1.0. Impacted is an unknown function. The manipulation results in cross-site request forgery. The attack may be launched remotely. The exploit has been made public and could be used.

AnalysisAI

Cross-site request forgery in CodeAstro Human Resource Management System 1.0 enables remote attackers to perform unauthorized state-changing actions - specifically department deletion - by tricking an authenticated user into visiting a crafted malicious page. The exploit targets the department deletion endpoint and publicly available proof-of-concept code has been published on GitHub, lowering the bar for exploitation. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify target org running CodeAstro HRMS
Delivery
Craft malicious CSRF HTML payload targeting department deletion endpoint
Exploit
Deliver payload link via phishing to authenticated HR admin
Execution
Victim browses to attacker page
Persist
Browser auto-submits forged deletion request with session cookie
Impact
Department record deleted without victim awareness
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that a human user with an active authenticated session in the CodeAstro HR Management System visit or be redirected to an attacker-controlled page or resource that contains the forged CSRF payload. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 5.3 with vector AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N reflects a medium-severity, integrity-limited vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker crafts a web page containing a hidden HTML form that auto-submits a POST request to the target organization's CodeAstro HR system department deletion endpoint. The attacker then social-engineers an authenticated HR administrator into visiting the malicious page - for example, via a phishing email with a link disguised as an HR policy document. …
Remediation No vendor-released patch or fixed version has been identified at time of analysis; patch status is unknown as no advisory was found at https://codeastro.com/. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Human Resource Management System

View all
CVE-2024-35469 CRITICAL POC
9.8 May 30

A SQL injection vulnerability in /hrm/user/ in SourceCodester Human Resource Management System 1.0 allows attackers to e
CVE-2023-3391 CRITICAL POC
9.8 Jun 23

A vulnerability was found in SourceCodester Human Resource Management System 1.0. Rated critical severity (CVSS 9.8), th
CVE-2022-4273 CRITICAL POC
9.8 Dec 03

A vulnerability, which was classified as critical, has been found in SourceCodester Human Resource Management System 1.0
CVE-2022-43262 CRITICAL POC
9.8 Nov 16

Human Resource Management System v1.0 was discovered to contain a SQL injection vulnerability via the password parameter
CVE-2024-34221 HIGH POC
8.8 May 14

Sourcecodester Human Resource Management System 1.0 is vulnerable to Insecure Permissions resulting in privilege escalat
CVE-2022-43318 HIGH POC
8.8 Nov 07

Human Resource Management System v1.0 was discovered to contain a SQL injection vulnerability via the stateedit paramete
CVE-2024-34220 HIGH POC
7.5 May 14

Sourcecodester Human Resource Management System 1.0 is vulnerable to SQL Injection via the 'leave' parameter. Rated high
CVE-2022-4278 HIGH POC
7.2 Dec 03

A vulnerability was found in SourceCodester Human Resource Management System 1.0. Rated high severity (CVSS 7.2), this v
CVE-2024-13006 MEDIUM POC
6.9 Dec 29

A vulnerability, which was classified as critical, has been found in 1000 Projects Human Resource Management System 1.0.
CVE-2022-3473 MEDIUM POC
6.5 Oct 13

A vulnerability classified as critical has been found in SourceCodester Human Resource Management System. Rated medium s
CVE-2022-3470 MEDIUM POC
6.5 Oct 13

A vulnerability was found in SourceCodester Human Resource Management System. Rated medium severity (CVSS 6.5), this vul
CVE-2022-4279 MEDIUM POC
6.1 Dec 03

A vulnerability classified as problematic has been found in SourceCodester Human Resource Management System 1.0. Rated m

Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)

View all
CVE-2016-6277 HIGH POC
8.8
CVE-2014-100005 HIGH POC
8.0
CVE-2013-5696 MEDIUM POC
6.8
CVE-2020-36836 HIGH POC
8.0
CVE-2015-2295 MEDIUM POC
6.8
CVE-2016-6897 MEDIUM POC
6.5
CVE-2022-41622 HIGH POC
8.8
CVE-2025-2907 CRITICAL POC
9.8

Same technique CSRF

View all
CVE-2016-6277 HIGH POC
8.8
CVE-2014-100005 HIGH POC
8.0
CVE-2017-9757 HIGH POC
8.8
CVE-2013-5696 MEDIUM POC
6.8
CVE-2013-4152 MEDIUM POC
6.8
CVE-2024-7094 CRITICAL
9.8
CVE-2015-4624 HIGH POC
7.5
CVE-2020-36836 HIGH POC
8.0

Share

CVE-2026-13537 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy