CVE-2026-11510: CodeAstro Leave Management System add_leave.php sql injection

Published Jun 8, 2026

Updated

A security flaw has been discovered in CodeAstro Leave Management System 1.0. This affects an unknown part of the file /admin/addleave.php. Performing a manipulation of the argument typeofleave results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

Affected Software

1 affected component

Codeastro CodeAstro Leave Management System=1.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Remove
Remove CodeAstro Leave Management System 1.0 from your environment.
Uninstall CodeAstro Leave Management System 1.0 or remove the vulnerable /admin/add_leave.php page if the application or that functionality is not required.
Configuration
Disable or block access to /admin/add_leave.php until a vendor patch is available. This can be done by removing the file, configuring the web server to return 403 for that path, or disabling the related admin feature in the application configuration.
CodeAstro Leave Management System (admin/add_leave.php) access to /admin/add_leave.php = disabled
Compensating control
Restrict access to the /admin directory to trusted IP addresses (firewall, network ACLs, or web server allowlist) and deploy Web Application Firewall (WAF) rules to detect and block SQL injection attempts targeting the type_of_leave parameter.
Operational
Assume potential exploitation: review application and database logs for suspicious activity related to /admin/add_leave.php or the type_of_leave parameter, and rotate database and application credentials if any evidence of data access or compromise is found.

Event History

Jun 8, 2026

CVE Published

via MITRE·11:30 AM

Data Sourced

via MITRE·11:30 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-11510?

CVE-2026-11510 has a medium severity score of 6.3.

How do I fix CVE-2026-11510?

To fix CVE-2026-11510, update CodeAstro Leave Management System to the latest version that addresses this SQL injection vulnerability.

What is the impact of CVE-2026-11510?

CVE-2026-11510 can lead to unauthorized access and manipulation of the database due to SQL injection.

Is CVE-2026-11510 exploitable remotely?

Yes, CVE-2026-11510 can be exploited remotely through the vulnerable add_leave.php file.

Which software is affected by CVE-2026-11510?

CVE-2026-11510 affects the CodeAstro Leave Management System version 1.0.