CVE-2026-12131

6.3 MEDIUM

A weakness has been identified in CodeAstro Human Resource Management System 1.0

Published: 2026-06-12 · Last updated: 2026-06-12

Severity and scoring

CVSS: 6.3 MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CWE: CWE-74, CWE-89

Description

A weakness has been identified in CodeAstro Human Resource Management System 1.0. This vulnerability affects the function Invoice of the file \application\controllers\Payroll.php of the component Payroll Invoice Module. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-12131
[Other]https://codeastro.com/
[Other]https://github.com/ashikmd0507/CVE/tree/main/SQL-Injection-via-Payroll-Invoice-Module
[Other]https://vuldb.com/cve/CVE-2026-12131
[Other]https://vuldb.com/submit/837207
[Other]https://vuldb.com/vuln/370616
[Other]https://vuldb.com/vuln/370616/cti

Related CVEs

Same CWE

CVE-2026-12175 — A vulnerability was detected in CodeAstro Student Attendance Management System 1.0 (4.7 MEDIUM)
CVE-2026-6428 — SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 2... (7.6 HIGH)
CVE-2026-9848 — The WP Ticket plugin for WordPress is vulnerable to SQL Injection via the WordPress search query parameter (`s`) in versions up to, and i... (7.5 HIGH)
CVE-2026-54231 — A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport (5.5 MEDIUM)
CVE-2026-44172 — MariaDB server is a community developed fork of MySQL server