CVE-2026-13535

Name of the Vulnerable Software and Affected Versions CodeAstro Human Resource Management System version 1.0

Description An issue exists in the View Endpoint component where the GetFileInfo() function within the file hrsystem/application/models/Employee model.php is susceptible to SQL injection. This occurs when the ID argument is manipulated, allowing a remote attacker to execute unauthorized SQL commands.

Recommendations Update CodeAstro Human Resource Management System version 1.0 to a patched version. As a temporary mitigation, restrict access to the GetFileInfo() function or sanitize the ID argument to prevent SQL injection.