CVE-2026-15559: CodeAstro Simple Online Leave Management System POST accept.php sql injection
A vulnerability was detected in CodeAstro Simple Online Leave Management System 1.0. This affects an unknown part of the file /SimpleOnlineLeave/admin/accept.php of the component POST Handler. Performing a manipulation of the argument appid results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15559?
CVE-2026-15559 has a medium severity rating of 6.3.
How does CVE-2026-15559 affect the CodeAstro Simple Online Leave Management System?
CVE-2026-15559 allows for SQL injection through manipulation of the appid argument in the accept.php file.
What could an attacker achieve by exploiting CVE-2026-15559?
Exploitation of CVE-2026-15559 could allow attackers to execute arbitrary SQL queries on the database.
How can organizations mitigate CVE-2026-15559?
Organizations can mitigate CVE-2026-15559 by validating and sanitizing user inputs, particularly the appid parameter.
Is there a fix available for CVE-2026-15559?
As of now, there are no specific patches or fixes available for CVE-2026-15559, and users should apply best practices for SQL injection prevention.