CodeAstro vulnerabilities
Published CVEs affecting CodeAstro products: 75 record(s), with severity, exploitation and fixes.
Online Classroom 13Gym Management System 11Leave Management System 7Human Resource Management System 7Online Job Portal 5Student Attendance Management System 5Real Estate Management System 4Membership Management System 3Simple Banking System 3Simple Inventory System 3Payroll System 3Online Leave Application 2Complaint Management System 2Ingredients Stock Management System 2Simple Loan Management System 1Online Catering Ordering System 1Food Ordering System 1Student Grading System 1Electricity Billing System 1
CVE-2026-104625
Medium · 6.3
CWE-74 Oct 2, 2026
CodeAstro Simple Loan Management System index.php sql injection
A security flaw has been discovered in CodeAstro Simple Loan Management System 1.0. Impacted is an unknown function of the file /admin/index.php. Performing a manipulation of the argument g_name results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
CVE-2026-13558
Low · 3.5
CWE-79 Jun 29, 2026
CodeAstro Complaint Management System Report addreport cross site scripting
A security flaw has been discovered in CodeAstro Complaint Management System 1.0. This issue affects some unknown processing of the file /report/addreport of the component Report Handler. Performing a manipulation of the argument Report Title results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
CVE-2026-13549
Medium · 5.4
CWE-285 Jun 29, 2026
CodeAstro Complaint Management System Report Endpoint Report.php deletereport authorization
A security flaw has been discovered in CodeAstro Complaint Management System 1.0. The affected element is the function deletereport of the file application/controllers/Report.php of the component Report Endpoint. The manipulation results in authorization bypass. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
CVE-2026-13537
Medium · 4.3
CWE-352 Jun 29, 2026
CodeAstro Human Resource Management System cross-site request forgery
A vulnerability was found in CodeAstro Human Resource Management System 1.0. Impacted is an unknown function. The manipulation results in cross-site request forgery. The attack may be launched remotely. The exploit has been made public and could be used.
CVE-2026-13535
Medium · 6.3
CWE-74 Jun 29, 2026
CodeAstro Human Resource Management System View Endpoint Employee_model.php GetFileInfo sql injection
A flaw has been found in CodeAstro Human Resource Management System 1.0. This vulnerability affects the function GetFileInfo of the file hrsystem/application/models/Employee_model.php of the component View Endpoint. Executing a manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used.
CVE-2026-13525
Medium · 6.3
CWE-74 Jun 29, 2026
CodeAstro Human Resource Management System Update_Earn_Leave Endpoint Employee_model.php emselectByCode sql injection
A vulnerability was detected in CodeAstro Human Resource Management System 1.0. This issue affects the function emselectByCode of the file application/models/Employee_model.php of the component Update_Earn_Leave Endpoint. The manipulation of the argument emid results in sql injection. The attack can be launched remotely. The exploit is now public and may be used.
CVE-2026-12175
Medium · 4.7
CWE-74 Jun 13, 2026
CodeAstro Student Attendance Management System createStudents.php sql injection
A vulnerability was detected in CodeAstro Student Attendance Management System 1.0. Impacted is an unknown function of the file /attendance-php/Admin/createStudents.php. Performing a manipulation of the argument admissionNumber results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.
CVE-2026-12131
Medium · 6.3
CWE-74 Jun 12, 2026
CodeAstro Human Resource Management System Payroll Invoice Payroll.php sql injection
A weakness has been identified in CodeAstro Human Resource Management System 1.0. This vulnerability affects the function Invoice of the file \application\controllers\Payroll.php of the component Payroll Invoice Module. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
CVE-2026-12130
Low · 3.5
CWE-79 Jun 12, 2026
CodeAstro Human Resource Management System Projects Management Add_Projects cross site scripting
A security flaw has been discovered in CodeAstro Human Resource Management System 1.0. This affects an unknown part of the file /Projects/Add_Projects of the component Projects Management Page. The manipulation of the argument protitle results in cross site scripting. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
CVE-2026-12129
Low · 3.5
CWE-79 Jun 12, 2026
CodeAstro Human Resource Management System Dashboard add_tod cross site scripting
A vulnerability was identified in CodeAstro Human Resource Management System 1.0. Affected by this issue is some unknown functionality of the file /dashboard/add_tod of the component Dashboard Interface. The manipulation of the argument todo_data leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly available and might be used.
CVE-2026-11585
Medium · 6.3
CWE-74 Jun 8, 2026
CodeAstro Student Attendance Management System createClassArms.php sql injection
A vulnerability was determined in CodeAstro Student Attendance Management System 1.0. Affected is an unknown function of the file /attendance-php/Admin/createClassArms.php. This manipulation of the argument classId causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2026-11584
Medium · 6.3
CWE-74 Jun 8, 2026
CodeAstro Student Attendance Management System createClass.php edit sql injection
A vulnerability was found in CodeAstro Student Attendance Management System 1.0. This impacts an unknown function of the file /attendance-php/Admin/createClass.php?action=edit. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.
CVE-2026-11583
Medium · 6.3
CWE-74 Jun 8, 2026
CodeAstro Student Attendance Management System createClass.php sql injection
A vulnerability has been found in CodeAstro Student Attendance Management System 1.0. This affects an unknown function of the file /attendance-php/Admin/createClass.php. The manipulation of the argument className leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2026-11582
High · 7.3
CWE-74 Jun 8, 2026
CodeAstro Student Attendance Management System index.php sql injection
A flaw has been found in CodeAstro Student Attendance Management System 1.0. The impacted element is an unknown function of the file /attendance-php/index.php. Executing a manipulation of the argument Username can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.
CVE-2026-11559
Medium · 6.3
CWE-74 Jun 8, 2026
CodeAstro Payroll System view_account.php sql injection
A vulnerability was detected in CodeAstro Payroll System 1.0. This affects an unknown function of the file /view_account.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.
CVE-2026-11558
Medium · 6.3
CWE-74 Jun 8, 2026
CodeAstro Payroll System home_salary.php sql injection
A security vulnerability has been detected in CodeAstro Payroll System 1.0. The impacted element is an unknown function of the file /home_salary.php. The manipulation of the argument rate/salary_rate leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
CVE-2026-11510
Medium · 6.3
CWE-74 Jun 8, 2026
CodeAstro Leave Management System add_leave.php sql injection
A security flaw has been discovered in CodeAstro Leave Management System 1.0. This affects an unknown part of the file /admin/add_leave.php. Performing a manipulation of the argument type_of_leave results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.
CVE-2026-11509
Medium · 6.3
CWE-74 Jun 8, 2026
CodeAstro Leave Management System search_staff_for_updation.php sql injection
A vulnerability was identified in CodeAstro Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/search_staff_for_updation.php. Such manipulation of the argument Name leads to sql injection. The attack may be performed from remote.
CVE-2026-11508
Medium · 6.3
CWE-74 Jun 8, 2026
CodeAstro Leave Management System search_staff_to_assign_pc.php sql injection
A vulnerability was determined in CodeAstro Leave Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/search_staff_to_assign_pc.php. This manipulation of the argument Name causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2026-11507
Medium · 6.3
CWE-74 Jun 8, 2026
CodeAstro Leave Management System delete_leave_type.php sql injection
A vulnerability was found in CodeAstro Leave Management System 1.0. Affected is an unknown function of the file /admin/delete_leave_type.php. The manipulation of the argument leave_type results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used.
CVE-2026-11506
Medium · 6.3
CWE-74 Jun 8, 2026
CodeAstro Leave Management System search_staff_for_deletion.php sql injection
A vulnerability has been found in CodeAstro Leave Management System 1.0. This impacts an unknown function of the file /admin/search_staff_for_deletion.php. The manipulation of the argument Name leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
CVE-2026-11495
Medium · 6.3
CWE-74 Jun 8, 2026
CodeAstro Ingredients Stock Management System add_stock.php sql injection
A vulnerability was detected in CodeAstro Ingredients Stock Management System 1.0. This impacts an unknown function of the file /Ingredients-Stock/add_stock.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.
CVE-2026-11491
Low · 2.4
CWE-79 Jun 8, 2026
CodeAstro Human Resource Management System Notice Board Management All_notice cross site scripting
A vulnerability was identified in CodeAstro Human Resource Management System 1.0. Impacted is an unknown function of the file /notice/All_notice of the component Notice Board Management. Such manipulation of the argument Notice Title with the input <svg onload="alert('Stored XSS Triggered by Ashik Mohamed')"> as part of POST leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
CVE-2026-10286
Medium · 6.3
CWE-74 Jun 1, 2026
CodeAstro Payroll System home_employee.php sql injection
A vulnerability was found in CodeAstro Payroll System 1.0. This affects an unknown part of the file /home_employee.php. The manipulation of the argument emp_id results in sql injection. The attack may be performed from remote. The exploit has been made public and could be used.
CVE-2026-10261
High · 7.3
CWE-74 Jun 1, 2026
CodeAstro Online Job Portal application_status.php sql injection
A flaw has been found in CodeAstro Online Job Portal 1.0. This affects an unknown function of the file /users/application_status.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used.