CVE-2026-15134 is a SQL injection vulnerability affecting CodeAstro Simple Online Leave Management System 1.0. The flaw exists in an unspecified functionality within /SimpleOnlineLeave/index.php, where manipulation of the 'email' parameter can lead to injection of malicious SQL code. The vulnerability is remotely exploitable without authentication or user interaction. Although publicly disclosed, there is no vendor-provided patch or official remediation guidance available at this time.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without privileges or user interaction, increasing its risk. However, the CVSS vector indicates low to low impact on confidentiality, integrity, and availability, consistent with a medium severity rating.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing application-layer input validation or web application firewall (WAF) rules to block malicious input targeting the 'email' parameter. Monitor vendor channels for updates and apply patches promptly once released.