CVE-2026-12131: medium-severity vulnerability in CodeAstro Human Resource Management System
CodeAstro Human Resource Management System Payroll Invoice Payroll.php sql injection
Published · Updated
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.3epss 0.3%
exploitation probability
0.3%top 85% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
A weakness has been identified in CodeAstro Human Resource Management System 1.0. This vulnerability affects the function Invoice of the file \application\controllers\Payroll.php of the component Payroll Invoice Module. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
CodeAstro · Human Resource Management Systempublic PoCs found — 1
cve_referencegithub.com/ashikmd0507/CVE/tree/main/SQL-Injection-via-Payroll-Invoice-Moduleunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — CodeAstro Human Resource Management System
In the same product, most dangerous first.
CVE-2026-13535MEDIUMCodeAstro Human Resource Management System View Endpoint Employee_model.php GetFileInfo sql injectionEPSS 0.3%CVE-2026-13525MEDIUMCodeAstro Human Resource Management System Update_Earn_Leave Endpoint Employee_model.php emselectByCode sql injectionEPSS 0.3%CVE-2026-13537MEDIUMCodeAstro Human Resource Management System cross-site request forgeryEPSS 0.2%CVE-2026-11491MEDIUMCodeAstro Human Resource Management System Notice Board Management All_notice cross site scriptingEPSS 0.2%CVE-2026-12130MEDIUMCodeAstro Human Resource Management System Projects Management Add_Projects cross site scriptingEPSS 0.2%CVE-2026-12129MEDIUMCodeAstro Human Resource Management System Dashboard add_tod cross site scriptingEPSS 0.2%