Threat database

CodeAstro Leave Management System version 1.0 contains a SQL injection vulnerability in the /admin/search_staff_for_deletion.php file. The vulnerability arises from improper handling of the 'Name' argument, allowing remote attackers to inject SQL commands. This flaw has been publicly disclosed but no official patch or fix is currently confirmed. The vulnerability has a medium severity rating with a CVSS score of 5.3.

CodeAstro Ingredients Stock Management System version 1.0 contains a SQL injection vulnerability in the /Ingredients-Stock/add_stock.php file. The vulnerability arises from improper handling of the ID argument, allowing remote attackers to inject SQL commands. This issue has a medium severity rating with a CVSS score of 5.3. No official patch or remediation guidance is currently available from the vendor. Exploit details are publicly known, but no active exploitation in the wild has been reported.

CodeAstro Human Resource Management System version 1.0 contains a cross-site scripting (XSS) vulnerability in the Notice Board Management component, specifically in the /notice/All_notice file. The vulnerability arises from improper handling of the Notice Title argument, allowing an attacker to inject malicious SVG content that executes JavaScript when loaded. This vulnerability can be exploited remotely via a crafted POST request. The CVSS score is 4.8, indicating a medium severity level. No official patch or remediation guidance is currently available from the vendor.

A vulnerability was found in CodeAstro Payroll System 1.0. This affects an unknown part of the file /home_employee.php. The manipulation of the argument emp_id results in sql injection. The attack may be performed from remote. The exploit has been made public and could be used.

A flaw has been found in CodeAstro Online Job Portal 1.0. This affects an unknown function of the file /users/application_status.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used.

A vulnerability was detected in CodeAstro Online Job Portal 1.0. The impacted element is an unknown function of the file /admin/jobs-admins/delete-jobs.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

A flaw has been found in CodeAstro Ingredients Stock Management System 1.0. This vulnerability affects unknown code of the file /Ingredients-Stock/stock_manager.php. This manipulation of the argument txt_search_category causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.

A weakness has been identified in CodeAstro Leave Management System 1.0. The affected element is an unknown function of the file /admin/add_staff.php. Executing a manipulation of the argument email_id can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

A vulnerability has been found in CodeAstro Online Catering Ordering System 1.0. This affects an unknown function of the file /deleteorder.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.

CVE-2026-8132 is a SQL injection vulnerability in CodeAstro Leave Management System version 1.0, specifically in an unknown function within /login.php. The vulnerability arises from improper handling of the txt_username parameter, allowing remote attackers to manipulate SQL queries. The exploit code has been publicly disclosed. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. No official patch or remediation guidance is currently available from the vendor. There are no confirmed exploits observed in the wild at this time.

CVE-2026-8097 is a medium severity SQL injection vulnerability in CodeAstro Online Classroom version 1.0. The flaw exists in the /askquery.php file where the squeryx parameter can be manipulated to perform SQL injection attacks remotely. The vulnerability has been publicly disclosed, but no official patch or remediation guidance is currently available from the vendor. Exploits have not been observed in the wild to date.

A vulnerability was determined in CodeAstro Online Classroom 1.0. This impacts an unknown function of the file /OnlineClassroom/facultydetails. This manipulation of the argument deleteid causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

CVE-2026-7744 is a medium-severity SQL injection vulnerability in CodeAstro Online Classroom version 1.0. The flaw exists in an unspecified function within the /OnlineClassroom/addnewstudent file, where manipulation of the 'fname' parameter allows SQL injection. This vulnerability can be exploited remotely without user interaction or elevated privileges. Although the exploit code has been publicly disclosed, there are no known exploits observed in the wild. No official patch or remediation guidance has been provided by the vendor at this time.

A vulnerability has been found in CodeAstro Online Classroom 1.0. The impacted element is an unknown function of the file /OnlineClassroom/studentdetails. The manipulation of the argument deleteid leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.

A flaw has been found in CodeAstro Online Classroom 1.0. The affected element is an unknown function of the file /OnlineClassroom/facultylogin. Executing a manipulation of the argument fid can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.

A vulnerability was detected in CodeAstro Online Classroom 1.0. Impacted is an unknown function of the file /OnlineClassroom/studentlogin. Performing a manipulation of the argument sid results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.

CVE-2026-7196 is a medium severity SQL injection vulnerability in CodeAstro Online Classroom version 1.0. It affects an unknown function in the /guestdetails file where the deleteid argument can be manipulated to perform SQL injection attacks remotely. The vulnerability has been publicly disclosed but there are no known exploits in the wild. No official patch or remediation guidance is currently available from the vendor.

A flaw has been found in CodeAstro Online Classroom 1.0. This affects an unknown part of the file /addnewfaculty. Executing a manipulation of the argument fname can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.

CVE-2026-7071 is a medium-severity vulnerability in CodeAstro Online Job Portal version 1.0 that allows remote attackers to expose file and directory information via manipulation of the /users/user-cvs/ file or directory. The vulnerability has been publicly disclosed but no official patch or remediation guidance is currently available from the vendor. Exploitation does not require privileges or user interaction. The CVSS 4.0 base score is 6.9, reflecting network attack vector and low complexity. No known exploits in the wild have been reported.

CVE-2026-7028 is a medium severity SQL injection vulnerability in CodeAstro Online Job Portal version 1.0. It affects an unknown function in the /admin/jobs-admins/delete-jobs.php file within the All Jobs Page component. The vulnerability arises from improper handling of the ID argument, allowing remote attackers to perform SQL injection. Although an exploit has been publicly released, there are no known exploits in the wild at this time. No official patch or remediation guidance has been provided by the vendor yet.