CVE-2026-15134

Name of the Vulnerable Software and Affected Versions CodeAstro Simple Online Leave Management System version 1.0

Description Remote SQL injection is possible via the /SimpleOnlineLeave/index.php endpoint. By manipulating the email parameter, an attacker can execute unauthorized database queries, which could lead to the exposure of employee data within internal HR and leave-management systems.

Recommendations Update CodeAstro Simple Online Leave Management System version 1.0 to a patched version. As a temporary mitigation, restrict access to the /SimpleOnlineLeave/index.php endpoint or sanitize the email parameter to prevent SQL injection.