PT-2026-43247 · Unknown · Codeastro Leave Management System

Wangchaoxing · Published 2026-05-26 · Updated 2026-05-26 · CVE-2026-9542

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CodeAstro Leave Management System version 1.0

Description A weakness in the file '/admin/add staff.php' allows for remote SQL injection. This occurs when the email id argument is manipulated, enabling an attacker to interfere with the application's database queries.

Recommendations Update CodeAstro Leave Management System to a version newer than 1.0. As a temporary workaround, restrict access to the '/admin/add staff.php' file or avoid using the email id parameter until a patch is applied.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2026-9542

Affected Products

Codeastro Leave Management System

References · 7

• 🔥 https://github.com/wangchaoxing/CVE/issues/8 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-9542 · Security Note
• https://t.me/CVEtracker/54975 · Telegram Post
• https://vuldb.com/vuln/365603/cti · Note
• https://vuldb.com/submit/814866 · Note
• https://codeastro.com · Note
• https://vuldb.com/vuln/365603 · Note