CVE-2026-13525

MEDIUM 6.3

CodeAstro Human Resource Management System Update_Earn_Leave Endpoint Employee_model.php emselectByCode sql injection

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was detected in CodeAstro Human Resource Management System 1.0. This issue affects the function emselectByCode of the file application/models/Employee_model.php of the component Update_Earn_Leave Endpoint. The manipulation of the argument emid results in sql injection. The attack can be launched remotely. The exploit is now public and may be used.

CWE	CWE-89 CWE-74
Vendor	codeastro
Product	human resource management system
Published	Jun 29, 2026

Stay Ahead of the Next One

Get instant alerts for codeastro human resource management system

Be the first to know when new medium vulnerabilities affecting codeastro human resource management system are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

CodeAstro / Human Resource Management System

1.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/374533 vuldb.com: https://vuldb.com/vuln/374533/cti vuldb.com: https://vuldb.com/cve/CVE-2026-13525 vuldb.com: https://vuldb.com/submit/840506 github.com: https://github.com/ashikmd0507/CVE/tree/main/Time-Based%20Blind%20SQL%20Injection%20in%20Update_Earn_Leave%20via%20emid%20Parameter codeastro.com: https://codeastro.com/

Credits

🔍 ashikmd7 (VulDB User)