Is there a public PoC exploit available for CVE-2026-15558?

Yes, a public proof-of-concept exploit is available for CVE-2026-15558. Prioritise patching immediately. EPSS: 0.2%.

CodeAstro Leave Management CVE-2026-15558

Q: What is the CVSS score of CVE-2026-15558?

CVE-2026-15558 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-43488 LOW

SQL Injection (CWE-89)

2026-07-13 VulDB

PHP SQLi Simple Online Leave Management System Codeastro

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network-reachable admin endpoint requires low-privilege auth; SQLi yields partial data read/write but no availability or scope impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 12:30 vuln.today

Severity Changed

Jul 13, 2026 - 12:22 NVD

MEDIUM LOW

CVSS changed

Jul 13, 2026 - 12:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

CVE Published

Jul 13, 2026 - 11:30 cve.org

LOW 2.1

DescriptionCVE.org

A security vulnerability has been detected in CodeAstro Simple Online Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /SimpleOnlineLeave/admin/deletemp.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

SQL injection in CodeAstro Simple Online Leave Management System 1.0 allows authenticated remote attackers to manipulate backend database queries via the 'ID' parameter in /SimpleOnlineLeave/admin/deletemp.php. The CVSS 4.0 vector (PR:L) indicates low-privilege authenticated access is sufficient to trigger the flaw, and a public proof-of-concept exploit has been disclosed on GitHub. Impact is assessed as low across confidentiality, integrity, and availability, consistent with the CVSS 4.0 score of 2.1, though the underlying SQL injection primitive could theoretically be chained to extract or corrupt database content.

Technical ContextAI

The affected product is a PHP-based web application - CodeAstro Simple Online Leave Management System version 1.0 (CPE: cpe:2.3:a:codeastro:simple_online_leave_management_system:*:*:*:*:*:*:*:*). The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), a classic SQL injection root cause where user-supplied input is concatenated into a SQL query without adequate sanitization or parameterized queries. The vulnerable file is /SimpleOnlineLeave/admin/deletemp.php, which likely performs a DELETE or SELECT operation using the 'ID' parameter directly in a SQL statement. The administrative path context suggests this endpoint is part of an employee/leave record management interface.

RemediationAI

No vendor-released patch has been identified at time of analysis for CodeAstro Simple Online Leave Management System 1.0; the disclosure appears to have been made via VulDB (https://vuldb.com/vuln/377907) and a GitHub proof-of-concept (https://github.com/sl1der-fr0g/Findings/issues/2) without an accompanying vendor fix announcement. Organizations running this application should immediately implement input validation and prepared statements (parameterized queries) in /SimpleOnlineLeave/admin/deletemp.php to sanitize the 'ID' parameter - this resolves the root cause. As compensating controls, restrict access to the /admin/ directory to trusted IP ranges via web server ACLs (e.g., Apache 'Require ip' or nginx 'allow/deny'), which limits exposure to the authenticated admin panel. Deploying a web application firewall (WAF) rule to block common SQL injection patterns on the ID parameter provides an additional detection and blocking layer, though WAF bypass is possible for a determined attacker. Given the educational/hobby nature of this product, replacing it with a maintained alternative is the lowest-risk long-term action.