CVE-2026-15134 is a SQL injection vulnerability affecting CodeAstro Simple Online Leave Management System version 1.0. The vulnerability exists in an unspecified functionality within the /SimpleOnlineLeave/index.php file, where manipulation of the 'email' parameter can lead to SQL injection. The attack vector is remote with no privileges or user interaction required. The vulnerability has been publicly disclosed but no official patch or remediation guidance has been provided by the vendor as of the publication date.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without authentication, increasing its risk. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround has been published, users should monitor for vendor updates and consider implementing input validation or web application firewall rules to mitigate SQL injection risks in the interim.