Is there a public PoC exploit available for CVE-2026-15559?

Yes, a public proof-of-concept exploit is available for CVE-2026-15559. Prioritise patching immediately. EPSS: 0.2%.

Simple Online Leave Management System CVE-2026-15559

Q: What is the CVSS score of CVE-2026-15559?

CVE-2026-15559 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

LOW

SQL Injection (CWE-89)

2026-07-13 VulDB

PHP SQLi Simple Online Leave Management System Codeastro

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

PR:L reflects mandatory low-privilege authentication confirmed by CVSS 4.0 source; S:U and low C/I/A match the bounded database-only impact with no lateral system scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 13, 2026 - 13:22 NVD

MEDIUM LOW

CVSS changed

Jul 13, 2026 - 13:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jul 13, 2026 - 13:16 vuln.today

CVE Published

Jul 13, 2026 - 12:00 cve.org

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was detected in CodeAstro Simple Online Leave Management System 1.0. This affects an unknown part of the file /SimpleOnlineLeave/admin/accept.php of the component POST Handler. Performing a manipulation of the argument appid results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.

AnalysisAI

SQL injection in CodeAstro Simple Online Leave Management System 1.0 exposes the admin accept handler to database manipulation by low-privilege authenticated remote attackers via the appid POST parameter in /SimpleOnlineLeave/admin/accept.php. The CVSS 4.0 vector (PR:L, VC:L/VI:L/VA:L) indicates constrained but real impact against the vulnerable system's database, with confidentiality, integrity, and availability all partially compromised. A public exploit is available on GitHub and the E:P evidence tag in the CVSS 4.0 vector corroborates this - however, no CISA KEV listing exists, meaning active exploitation at scale is not confirmed at time of analysis.

Technical ContextAI

The affected application is a PHP-based web system for managing employee leave requests, developed by CodeAstro. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) identifies the root cause: the appid POST parameter submitted to the admin accept/approve handler is concatenated into a backend SQL query without sanitization or parameterization, enabling injection of arbitrary SQL clauses. The CPE string cpe:2.3:a:codeastro:simple_online_leave_management_system:*:*:*:*:*:*:*:* uses a wildcard version field, indicating NVD has not bounded the vulnerable version range beyond the explicitly reported version 1.0. The vulnerability resides in the admin-facing PHP script /SimpleOnlineLeave/admin/accept.php, which handles POST requests to approve leave applications, a typical administrative workflow endpoint.

RemediationAI

No vendor-released patch has been identified at time of analysis; organizations should monitor VulDB at https://vuldb.com/cve/CVE-2026-15559 and the CodeAstro vendor site at https://codeastro.com/ for patch availability. As an immediate compensating control, restrict network access to the admin directory /SimpleOnlineLeave/admin/ to trusted IP ranges or require VPN connectivity - this reduces the attack surface to insider or already-compromised network segments, though it does not eliminate the vulnerability. Deploy a web application firewall rule to detect and block SQL injection patterns (e.g., quote characters, SQL keywords) in the appid POST body parameter targeting accept.php; note that WAF rules can be bypassed by sophisticated attackers and should not be treated as a definitive fix. Developers with access to the source should refactor the accept.php handler to use PHP PDO or MySQLi prepared statements with bound parameters, which eliminates the root cause entirely. Audit other POST handlers in the application for similar unsanitized parameter usage, as the wildcard CPE suggests the codebase may have systemic input-handling deficiencies.