Is there a public PoC exploit available for EUVD-2026-35043?

Yes, a public proof-of-concept exploit is available for EUVD-2026-35043. Prioritise patching immediately. EPSS: 0.0%.

Leave Management System EUVD-2026-35043

Q: What is the CVSS score of EUVD-2026-35043?

EUVD-2026-35043 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-11507 LOW

SQL Injection (CWE-89)

2026-06-08 VulDB

GHSA-44w4-q8j9-cjp5

PHP SQLi Leave Management System

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:46 vuln.today

Severity Changed

Jun 08, 2026 - 12:22 NVD

MEDIUM LOW

CVSS changed

Jun 08, 2026 - 12:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability was found in CodeAstro Leave Management System 1.0. Affected is an unknown function of the file /admin/delete_leave_type.php. The manipulation of the argument leave_type results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used.

AnalysisAI

SQL injection in CodeAstro Leave Management System 1.0 exposes the /admin/delete_leave_type.php endpoint to arbitrary database query manipulation via the unsanitized leave_type parameter. The CVSS 4.0 vector (PR:L) confirms that a low-privileged authenticated user can remotely trigger the injection without user interaction or additional attack complexity. A publicly available exploit exists on GitHub (no public exploit identified in CISA KEV), and the CVSS 4.0 score of 2.1 reflects limited confidentiality, integrity, and availability impact confined to the vulnerable component with no lateral scope change.

Technical ContextAI

CodeAstro Leave Management System 1.0 is a PHP-based HR web application (CPE: cpe:2.3:a:codeastro:leave_management_system:*:*:*:*:*:*:*:*). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The affected endpoint /admin/delete_leave_type.php accepts a leave_type argument that is passed directly into a backend SQL query without parameterization or input sanitization, allowing an attacker to append or alter the SQL logic. The CVSS 4.0 vector components AT:N (no additional attack requirements) and AC:L (low attack complexity) confirm the injection is straightforward to trigger with no race conditions or specialized environment needed.

RemediationAI

No vendor-released patch has been identified at time of analysis; the references point only to VulDB tracking entries (https://vuldb.com/vuln/369127) and the vendor's homepage (https://codeastro.com/) without a dedicated security advisory or patched release version. Organizations should contact CodeAstro directly to request a fix. As an immediate compensating control, replace all direct SQL string concatenation in delete_leave_type.php with parameterized queries or prepared statements - this eliminates the injection root cause without application-level side effects. If code modification is not immediately feasible, deploy a web application firewall (WAF) rule to detect and block SQL metacharacter patterns in the leave_type parameter; note that WAF rules may produce false positives on legitimate leave type names containing apostrophes. Additionally, restrict access to the /admin/ directory to only trusted IP ranges or enforce session-based authorization checks to ensure low-privilege users cannot reach admin endpoints, reducing exploitability until a patch is available.