PT-2026-57808 · Codeastro · Simple Online Leave Management System

Cshwswwsshd99 · Published 2026-07-13 · Updated 2026-07-13 · CVE-2026-15558

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CodeAstro Simple Online Leave Management System version 1.0

Description Remote SQL injection is possible due to improper handling of the ID variable in the '/SimpleOnlineLeave/admin/deletemp.php' endpoint. SQL injection is a technique where an attacker inserts malicious SQL code into a query, allowing them to manipulate the database.

Recommendations Update CodeAstro Simple Online Leave Management System version 1.0 to a patched version. As a temporary mitigation, restrict access to the '/SimpleOnlineLeave/admin/deletemp.php' endpoint.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2026-15558

Affected Products

Simple Online Leave Management System

References · 8

• 🔥 https://github.com/sl1der-fr0g/Findings/issues/2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-15558 · Security Note
• https://vuldb.com/vuln/377907/cti · Note
• https://twitter.com/MalwareObserver/status/2076693631235207467 · Twitter Post
• https://codeastro.com · Note
• https://vuldb.com/cve/CVE-2026-15558 · Note
• https://vuldb.com/vuln/377907 · Note
• https://vuldb.com/submit/855188 · Note