CVE-2026-13525: CodeAstro Human Resource Management System Update_Earn_Leave Endpoint Employee_model.php emselectByCode sql injection
A vulnerability was detected in CodeAstro Human Resource Management System 1.0. This issue affects the function emselectByCode of the file application/models/Employeemodel.php of the component UpdateEarnLeave Endpoint. The manipulation of the argument emid results in sql injection. The attack can be launched remotely. The exploit is now public and may be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13525?
CVE-2026-13525 has a severity score of 2.1, which is classified as low.
How do I fix CVE-2026-13525?
To remediate CVE-2026-13525, update the CodeAstro Human Resource Management System to the latest version that addresses this SQL injection vulnerability.
What component is affected by CVE-2026-13525?
CVE-2026-13525 affects the Update_Earn_Leave Endpoint in the Employee_model.php file of the CodeAstro Human Resource Management System.
What type of vulnerability is CVE-2026-13525?
CVE-2026-13525 is classified as an SQL Injection vulnerability.
What potentially can be exploited in CVE-2026-13525?
An attacker can exploit CVE-2026-13525 by manipulating the emid argument to execute unauthorized SQL queries.