Is there a public PoC exploit available for EUVD-2026-40035?

Yes, a public proof-of-concept exploit is available for EUVD-2026-40035. Prioritise patching immediately. EPSS: 0.2%.

CodeAstro HRMS EUVD-2026-40035

Q: What is the CVSS score of EUVD-2026-40035?

EUVD-2026-40035 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-13537 LOW

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-29 VulDB

GHSA-c7qf-p72p-2xj2

CSRF Human Resource Management System Codeastro

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-reachable CSRF with no attacker privileges; mandatory user interaction (UI:R); integrity-only impact limited to department data deletion.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Jun 29, 2026 - 06:22 NVD

MEDIUM LOW

CVSS changed

Jun 29, 2026 - 06:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 29, 2026 - 05:48 vuln.today

DescriptionCVE.org

A vulnerability was found in CodeAstro Human Resource Management System 1.0. Impacted is an unknown function. The manipulation results in cross-site request forgery. The attack may be launched remotely. The exploit has been made public and could be used.

AnalysisAI

Cross-site request forgery in CodeAstro Human Resource Management System 1.0 enables remote attackers to perform unauthorized state-changing actions - specifically department deletion - by tricking an authenticated user into visiting a crafted malicious page. The exploit targets the department deletion endpoint and publicly available proof-of-concept code has been published on GitHub, lowering the bar for exploitation. No active exploitation has been confirmed by CISA KEV, but the combination of a public PoC, network-accessible attack vector, and no required attacker privileges makes this an accessible target for opportunistic attackers against organizations running this software.

Technical ContextAI

CWE-352 (Cross-Site Request Forgery) arises when a web application processes state-changing HTTP requests without verifying that the request originated from the legitimate user session, rather than a forged third-party request. In this case, the department deletion endpoint in CodeAstro Human Resource Management System 1.0 (CPE: cpe:2.3:a:codeastro:human_resource_management_system:*:*:*:*:*:*:*:*) lacks CSRF token validation, meaning any page on the internet can craft a form that submits a deletion request using the victim's browser cookies. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:P confirms the attack is network-reachable, requires no attacker-side authentication, has no special attack complexity, but does require the victim to interact with attacker-controlled content. CodeAstro is a PHP-based HR management product, likely built without a security-conscious framework enforcing automatic CSRF protection.

RemediationAI

No vendor-released patch or fixed version has been identified at time of analysis; patch status is unknown as no advisory was found at https://codeastro.com/. Organizations running CodeAstro Human Resource Management System 1.0 should implement the following compensating controls: first, deploy a web application firewall (WAF) with CSRF protection rules to intercept forged cross-origin POST requests to the department deletion endpoint - trade-off is potential false positives on legitimate requests. Second, restrict administrative HR functions to a VPN or allowlisted IP range to reduce the attack surface, accepting reduced accessibility for remote staff. Third, enforce strict browser security headers including SameSite=Strict on session cookies, which prevents cookies from being sent in cross-origin requests and effectively neutralizes CSRF in modern browsers - verify the application server supports this without breaking functionality. The GitHub PoC (https://github.com/ashikmd0507/CVE/tree/main/CSRF%20in%20Department%20Deletion%20Endpoint) can be used to confirm whether a deployed instance remains vulnerable after mitigations are applied.