CVE-2026-15478 is a SQL injection vulnerability affecting IceHRM up to versions 35.0.0 and 35.0.1. The issue exists in the file core/src/Reports/User/Reports/EmployeeAttendanceReport.php within the UserReport endpoint. An attacker can remotely exploit this vulnerability by manipulating the employeeList argument, leading to unauthorized SQL query execution. Although the exploit code is publicly available, the vendor has not yet issued a fix or official remediation guidance.

Successful exploitation of this vulnerability could allow an attacker with network access and low privileges to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access or modification within the affected IceHRM system. The CVSS 4.0 base score of 5.3 reflects a medium severity with network attack vector, low attack complexity, and no user interaction required.

No official patch or remediation guidance is currently available from the vendor. Users should monitor the vendor's communications for updates and consider implementing temporary protective measures such as input validation or restricting access to the vulnerable endpoint. Since the exploit is public, caution and increased monitoring are advised until a fix is released.