CVE-2026-14660
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
A SQL injection vulnerability was found in Online Job Portal 1.0 in the login.php file. Manipulating the txtUser or txtPass arguments allows remote execution of unauthorized database queries. The exploit has been published, increasing the attack risk.
Risk Assessment
An attacker can gain unauthorized access to the database, steal user data, or take control of the portal. The published exploit makes the attack easier to perform without advanced skills.
Recommendation
Immediately update the system to the latest version or apply a security patch. Additionally, implement input validation and parameterized SQL queries in the login.php file.
Other vulnerabilities in Online Job Portal
See all- CVE-2026-15678Low
A security vulnerability has been detected in code-projects Online Job Portal 1.0. An unknown function in the file /Admin/DetailJob.php leads to cross-site scripting (XSS). The attack can be carried out remotely, and the exploit has been publicly disclosed.
- CVE-2026-15677High
A vulnerability has been found in Online Job Portal 1.0, allowing unrestricted file upload via the txtFile argument in /JobSeekerInsert.php. The attack can be performed remotely, and a public exploit is available.
- CVE-2026-15676High
A security flaw was discovered in code-projects Online Job Portal up to version 1.0. An unknown function in the file /Admin/DeleteUser.php allows SQL injection. Remote exploitation is possible and the exploit has been publicly released.
- CVE-2026-15675High
A SQL Injection vulnerability was found in Online Job Portal 1.0 in the file /Admin/EditUser.php. An attacker can remotely manipulate the UserId argument, leading to SQL injection. The exploit is publicly available.
Original NVD description (English source)
A vulnerability was found in code-projects Online Job Portal 1.0. The affected element is an unknown function of the file login.php. Performing a manipulation of the argument txtUser/txtPass results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used.