CVE-2026-15559 is a SQL injection vulnerability affecting CodeAstro Simple Online Leave Management System version 1.0. The issue exists in the POST handler component of the /SimpleOnlineLeave/admin/accept.php file, where the 'appid' argument is not properly sanitized. This allows remote attackers to inject malicious SQL code by manipulating the 'appid' parameter. The vulnerability has been assigned a CVSS 4.0 base score of 5.3 (medium severity). Although an exploit is publicly available, there is no official patch or remediation level indicated by the vendor or authoritative sources at this time.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without user interaction and requires low attack complexity with low privileges. The overall impact is rated medium based on the CVSS score of 5.3.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing input validation and parameterized queries as a temporary mitigation to prevent SQL injection via the 'appid' parameter. Monitor vendor communications for updates on patches or official mitigations.