CVE-2026-15558 is a SQL injection vulnerability affecting CodeAstro Simple Online Leave Management System version 1.0. The flaw exists in the deletemp.php script within the admin directory, where the ID parameter is not properly sanitized, enabling remote attackers to inject malicious SQL code. This can lead to unauthorized database queries or modifications. The vulnerability is publicly known but no official fix or patch has been released as of the publication date.

Successful exploitation of this vulnerability could allow an attacker with low privileges to execute arbitrary SQL commands on the backend database remotely. This may result in unauthorized data access, data modification, or other impacts depending on the database and application context. The CVSS 4.0 score of 5.3 reflects a medium severity with network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected script and monitor for suspicious activity related to the ID parameter. Avoid exposing the vulnerable interface to untrusted networks if possible.