PT-2026-53205 · Codeastro · Human Resource Management System

Ashikmd7 · Publicado 2026-06-29 · Atualizado 2026-06-29 · CVE-2026-13535

Mitre

CVSS v3.1

6.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

A flaw has been found in CodeAstro Human Resource Management System 1.0. This vulnerability affects the function GetFileInfo of the file hrsystem/application/models/Employee model.php of the component View Endpoint. Executing a manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used.

Exploit

Correção

SQL injection

Special Elements Injection

Enumeração de Fraquezas

CWE-89

CWE-74

Identificadores relacionados

CVE-2026-13535

Produtos afetados

Human Resource Management System

Referências · 7

• 🔥 https://github.com/ashikmd0507/CVE/tree/main/SQL%20Injection%20via%20GetFileInfo%20Function · Exploit
• https://vuldb.com/vuln/374543/cti · Nota
• https://vuldb.com/vuln/374543 · Nota
• https://vuldb.com/cve/CVE-2026-13535 · Nota
• https://codeastro.com · Nota
• https://vuldb.com/submit/842053 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-13535 · Nota de Segurança