Is there a public PoC exploit available for CVE-2026-9542?

Yes, a public proof-of-concept exploit is available for CVE-2026-9542. Prioritise patching immediately. EPSS: 0.0%.

Leave Management System CVE-2026-9542

Q: What is the CVSS score of CVE-2026-9542?

CVE-2026-9542 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31815 LOW

SQL Injection (CWE-89)

2026-05-26 VulDB

GHSA-jmrp-7jjm-qhcc

PHP SQLi Leave Management System

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 12:53 vuln.today

Severity Changed

May 26, 2026 - 14:22 NVD

MEDIUM LOW

CVSS changed

May 26, 2026 - 14:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A weakness has been identified in CodeAstro Leave Management System 1.0. The affected element is an unknown function of the file /admin/add_staff.php. Executing a manipulation of the argument email_id can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

SQL injection in CodeAstro Leave Management System 1.0 allows authenticated remote attackers to manipulate the email_id parameter in /admin/add_staff.php, enabling arbitrary SQL query manipulation against the underlying database. The CVSS 4.0 score of 2.1 (Low) reflects constrained impact scope - confidentiality, integrity, and availability are each rated Low with no lateral impact to subsequent systems - and EPSS at 0.03% (8th percentile) indicates negligible real-world exploitation probability despite a publicly available proof-of-concept on GitHub. No active exploitation has been confirmed and this CVE is not listed in the CISA KEV catalog.

Technical ContextAI

CodeAstro Leave Management System 1.0 is a PHP-based human-resources web application (CPE: cpe:2.3:a:codeastro:leave_management_system:*:*:*:*:*:*:*:*). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controlled input - specifically the email_id POST or GET parameter - is concatenated into a backend SQL query in /admin/add_staff.php without sanitization or parameterization. This classic unsanitized-input pattern allows an attacker to inject SQL syntax that alters query logic, potentially enumerating tables, dumping credentials, or modifying records. The CVSS 4.0 Exploit Maturity modifier E:P confirms a proof-of-concept is factored into scoring.

RemediationAI

No vendor-released patch has been identified at time of analysis. The vendor's product page (https://codeastro.com/) should be monitored for an updated release. In the absence of a patch, the most effective compensating control is to refactor the email_id parameter handling in /admin/add_staff.php to use prepared statements with parameterized queries (PDO or MySQLi), which eliminates the injection surface entirely without side effects. As an interim measure, restrict access to the /admin/ directory via IP allowlist at the web server or firewall level - this directly addresses the PR:L requirement by limiting who can reach the vulnerable endpoint, though it may impact legitimate remote admin workflows. Deploying a Web Application Firewall (WAF) rule targeting SQL injection patterns in the email_id parameter provides an additional detection and blocking layer but should not be treated as a primary control due to bypass risk. Vulnerability details and the POC are tracked at https://vuldb.com/vuln/365603.