Is there a public PoC exploit available for CVE-2026-8132?

Yes, a public proof-of-concept exploit is available for CVE-2026-8132. Prioritise patching immediately. EPSS: 0.0%.

CodeAstro Leave Management System CVE-2026-8132

Q: What is the CVSS score of CVE-2026-8132?

CVE-2026-8132 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-28521 MEDIUM

SQL Injection (CWE-89)

2026-05-08 VulDB

GHSA-gggm-v39x-cpg8

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 08, 2026 - 04:34 vuln.today

Severity Changed

May 08, 2026 - 04:22 NVD

HIGH MEDIUM

CVSS changed

May 08, 2026 - 04:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

CVE Published

May 08, 2026 - 03:15 nvd

MEDIUM 5.5

DescriptionCVE.org

A weakness has been identified in CodeAstro Leave Management System 1.0. Affected is an unknown function of the file /login.php. This manipulation of the argument txt_username causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

SQL injection in CodeAstro Leave Management System 1.0 allows remote unauthenticated attackers to manipulate the txt_username parameter in /login.php, enabling database queries to be executed with low confidentiality and integrity impact. Publicly available exploit code exists for this vulnerability, increasing real-world exploitation risk despite the moderate CVSS score of 5.5.

Technical ContextAI

The vulnerability exists in the authentication handler at /login.php, where user input from the txt_username parameter is passed unsafely to SQL queries without proper parameterized statements or input validation. This is a classic CWE-89 SQL injection flaw in a PHP-based web application. The attack vector is network-based (AV:N) with low attack complexity (AC:L), meaning no special conditions are required beyond network access. The affected product is a leave management system built on PHP, a common framework for administrative and HR applications. The CPE indicates all versions of CodeAstro Leave Management System are potentially vulnerable, though version 1.0 is explicitly named.

RemediationAI

Immediate remediation requires contacting CodeAstro to obtain a patched version, as no specific fix version is referenced in available data. In the interim, apply the following compensating controls: (1) Implement Web Application Firewall (WAF) rules to block SQL injection patterns in the txt_username parameter (e.g., reject requests containing single quotes, double dashes, UNION keywords, or SQL comments) - trade-off is potential false positives on legitimate usernames containing special characters; (2) Restrict network access to /login.php to known IP ranges or corporate networks only, reducing the attack surface from global internet to trusted networks - trade-off is loss of remote access capability; (3) Disable the CodeAstro Leave Management System until a patch is available if the application is not business-critical. Contact CodeAstro at https://codeastro.com/ to report the vulnerability and request security updates. Monitor VulDB (https://vuldb.com/vuln/361922) for patch announcements.