CVE-2026-13535

creationtimestamp| type| source ---|---|--- 2026-06-29 08:28:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpg2zqxq6j2a 2026-06-29 10:47:55+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgcshrsp62n...

CVE-2026-13535

CodeAstro HRMS 1.0 is affected by an SQL injection in the View Endpoint’s GetFileInfo (Employee_model.php). Manipulating the ID argument enables remote SQL injection, with proofs-of-concept published. Root cause: unsafely concatenated or unsanitized ID in GetFileInfo; impact is limited to confide...