CVE-2026-11506 is a SQL injection vulnerability affecting CodeAstro Leave Management System version 1.0. The issue is located in the /admin/search_staff_for_deletion.php file where the 'Name' parameter is not properly sanitized, enabling remote attackers to execute arbitrary SQL commands. The vulnerability is remotely exploitable without user interaction and requires low privileges. Although the exploit details are publicly known, there is no official remediation or patch available as of the publication date.

Successful exploitation of this vulnerability could allow an attacker to manipulate the backend database via SQL injection, potentially leading to unauthorized data access or modification. The CVSS score of 5.3 indicates a medium impact level, reflecting limited privileges required and low complexity of attack. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable functionality and apply any available workarounds recommended by the vendor. Monitoring for suspicious activity related to the affected parameter is advisable.