CVE-2026-15134

HighCVSS 7.3/10Last modified Jul 9, 2026

Description

A vulnerability was determined in CodeAstro Simple Online Leave Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /SimpleOnlineLeave/index.php. Executing a manipulation of the argument email can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74 CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Jul 9, 2026
Last modified: Jul 9, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-151357.3A security flaw has been discovered in code-projects Online Food Order System 1.0. This affects an unknown part of the file /edit_food_items CVE-2026-151364.3The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up CVE-2026-151377.3A weakness has been identified in code-projects Interview Management System 1.0. This vulnerability affects unknown code of the file \inc\cl CVE-2026-151386.3A security vulnerability has been detected in tumf mcp-text-editor up to 1.0.2. This issue affects the function _validate_file_path of the f CVE-2026-15146.5Official Document Management System developed by 2100 Technology has a Incorrect Authorization vulnerability, allowing authenticated remote CVE-2026-151407.7A privilege-escalation issue in the Portworx Operator when deployed on Red Hat OpenShift (OCP). Only under specific conditions during the in CVE-2026-151415.7The web interface of the affected device relies on the HTTP referrer header as part of request validation. Requests containing empty Refere CVE-2026-151427.5The Real Estate Manager Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 12.8.6. This is CVE-2026-151439.3A flaw was found in the file_type content detector of guardrails-detectors. This vulnerability allows a remote attacker to supply an arbitra CVE-2026-151445.3@fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 c CVE-2026-151456.4The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting CVE-2026-151465.9GNU Wget does not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or a