CVE-2026-15676
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A security flaw was discovered in code-projects Online Job Portal up to version 1.0. An unknown function in the file /Admin/DeleteUser.php allows SQL injection. Remote exploitation is possible and the exploit has been publicly released.
Risk Assessment
The organization is at risk of unauthorized database access, data leakage, and potential system takeover through remote SQL injection attacks.
Recommendation
Immediately update the Online Job Portal to the latest version or apply a security patch. Restrict access to /Admin/DeleteUser.php and implement input validation as a temporary measure.
Other vulnerabilities in Online Job Portal
See all- CVE-2026-15678Low
A security vulnerability has been detected in code-projects Online Job Portal 1.0. An unknown function in the file /Admin/DetailJob.php leads to cross-site scripting (XSS). The attack can be carried out remotely, and the exploit has been publicly disclosed.
- CVE-2026-15677High
A vulnerability has been found in Online Job Portal 1.0, allowing unrestricted file upload via the txtFile argument in /JobSeekerInsert.php. The attack can be performed remotely, and a public exploit is available.
- CVE-2026-15675High
A SQL Injection vulnerability was found in Online Job Portal 1.0 in the file /Admin/EditUser.php. An attacker can remotely manipulate the UserId argument, leading to SQL injection. The exploit is publicly available.
- CVE-2026-14660High
A SQL injection vulnerability was found in Online Job Portal 1.0 in the login.php file. Manipulating the txtUser or txtPass arguments allows remote execution of unauthorized database queries. The exploit has been published, increasing the attack risk.
Original NVD description (English source)
A security flaw has been discovered in code-projects Online Job Portal up to 1.0. The impacted element is an unknown function of the file /Admin/DeleteUser.php. Performing a manipulation results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.