CVE-2026-8132

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

A weakness has been identified in CodeAstro Leave Management System 1.0. Affected is an unknown function of the file /login.php. This manipulation of the argument txt_username causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-89

Affected software

No affected versions have been published.

Timeline

Published
May 8, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-813205.5A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the CVE-2026-813219.8CM2507 IP cameras store configured wireless network credentials in cleartext within the device filesystem. An attacker who obtains filesysteCVE-2026-813222.1Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ash_cloak allows anyone with access to logs, error tCVE-2026-813266.8QND uses a hard-coded cryptographic key, which may allow a local attacker who is logged in to a Windows PC where the affected product's clieCVE-2026-81337.3A security vulnerability has been detected in zyx0814 FilePress up to 2.2.0. Affected by this vulnerability is an unknown functionality of tCVE-2026-813306.5The C6 ear camera transmits live video to the EarVision Android application over unencrypted UDP streams. The application manifest permits cCVE-2026-813346.1darknet subscripts its layer array with an index taken from a configuration file without checking it against the array's length. The array iCVE-2026-813357.5Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name vieCVE-2026-813384.6The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content CVE-2026-813394.3The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform a per-object ownership check when returning a quiz attCVE-2026-81347.2Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when savinCVE-2026-813403.8The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updatin
CVE-2026-8132: High severity, CVSS 7.3 | Vulnix