CVE-2026-13535 is a SQL injection vulnerability affecting CodeAstro Human Resource Management System 1.0. The issue exists in the GetFileInfo function of hrsystem/application/models/Employee_model.php, specifically in the View Endpoint component. By manipulating the ID parameter, an attacker can perform SQL injection remotely. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. No vendor-provided patch or official remediation is currently available, and the vulnerability is publicly disclosed with exploit code published.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The medium severity score reflects limited privileges required (low) and low complexity, but the impact on confidentiality, integrity, and availability is limited to low. There are no confirmed reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing input validation or parameterized queries as a temporary mitigation. Monitor vendor channels for updates and apply patches promptly once available.