Is there a public PoC exploit available for EUVD-2026-43200?

Yes, a public proof-of-concept exploit is available for EUVD-2026-43200. Prioritise patching immediately. EPSS: 0.2%.

IceHRM EUVD-2026-43200

Q: What is the CVSS score of EUVD-2026-43200?

EUVD-2026-43200 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-15478 LOW

SQL Injection (CWE-89)

2026-07-12 VulDB

GHSA-vrmm-g397-5ggh

PHP SQLi N A Icehrm

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-reachable SQL injection requiring low-privilege authentication with limited database-level C/I/A impact and no scope change beyond the vulnerable application.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 12, 2026 - 05:22 NVD

MEDIUM LOW

CVSS changed

Jul 12, 2026 - 05:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jul 12, 2026 - 05:15 vuln.today

DescriptionCVE.org

A flaw has been found in IceHRM up to 35.0.1. This impacts an unknown function of the file core/src/Reports/User/Reports/EmployeeAttendanceReport.php of the component UserReport Endpoint. Executing a manipulation of the argument employeeList can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

SQL injection in IceHRM 35.0.1 and earlier allows authenticated remote attackers to manipulate backend database queries via the employeeList parameter in the EmployeeAttendanceReport PHP component, yielding partial confidentiality, integrity, and availability impact. A public proof-of-concept is available via a GitHub issue report, and the IceHRM project has not responded to the disclosure, leaving no vendor patch available. No CISA KEV listing exists, so widespread active exploitation at scale is unconfirmed, but the public PoC and unpatched status materially elevate practical risk for any organization running this software.

Technical ContextAI

IceHRM is an open-source PHP-based human resource management system. The vulnerability exists in core/src/Reports/User/Reports/EmployeeAttendanceReport.php within the UserReport endpoint, where the employeeList argument supplied by the user is incorporated into a SQL query without proper parameterization or escaping - the root cause class identified by CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). This classic unsanitized input-to-query concatenation pattern in PHP applications allows an attacker to alter query logic, enumerate database contents, or modify records. The affected CPE is cpe:2.3:a:n/a:icehrm:*:*:*:*:*:*:*:*, covering all releases through 35.0.1. The CVSS 4.0 vector's E:P modifier confirms exploit code maturity at the proof-of-concept level.

RemediationAI

No vendor-released patch has been identified at time of analysis - the IceHRM maintainers were notified via issue report (https://github.com/gamonoid/icehrm/issues/376) but have not responded. As an immediate compensating control, restrict access to the UserReport and EmployeeAttendanceReport endpoint using application-layer ACLs or web server configuration, limiting it to the minimum set of users who require attendance reporting functionality. Deploying a WAF rule targeting SQL injection patterns specifically on the employeeList POST or GET parameter will reduce exploitation risk, though WAF rules can be bypassed by determined attackers and may introduce false positives on legitimate comma-separated employee list values. Harden database permissions so the IceHRM application database account is limited to SELECT-only on the relevant tables where INSERT/UPDATE/DELETE are not operationally required, reducing the blast radius of any successful injection. Monitor https://vuldb.com/vuln/377783 and the GitHub issue for patch availability, and consider evaluating a fork or community-maintained patch if the upstream project remains unresponsive.