Carmelo Simple Leave Manager vulnerabilities

2 CVEs affecting Carmelo Simple Leave Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-14223, published 2025-12-08.

More from Carmelo.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2025-11556, published 2025-10-09. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw has been found in code-projects Simple Leave Manager 1.0. This vulnerability affects unknown code of the file /user.php. This manipulation of the argument table causes sql injection. Remote…
• CVE-2025-14223, published 2025-12-08. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability has been found in code-projects Simple Leave Manager 1.0. Affected by this vulnerability is an unknown functionality of the file /request.php. Such manipulation of the argument…