CVE-2026-15677
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A vulnerability has been found in Online Job Portal 1.0, allowing unrestricted file upload via the txtFile argument in /JobSeekerInsert.php. The attack can be performed remotely, and a public exploit is available.
Risk Assessment
The risk involves remote upload of malicious files, potentially leading to server compromise, data theft, or lateral movement within the organization's network.
Recommendation
Immediately update Online Job Portal to the latest version or apply a security patch. As a temporary measure, disable file upload functionality or restrict access to /JobSeekerInsert.php.
Other vulnerabilities in Online Job Portal
See all- CVE-2026-15678Low
A security vulnerability has been detected in code-projects Online Job Portal 1.0. An unknown function in the file /Admin/DetailJob.php leads to cross-site scripting (XSS). The attack can be carried out remotely, and the exploit has been publicly disclosed.
- CVE-2026-15676High
A security flaw was discovered in code-projects Online Job Portal up to version 1.0. An unknown function in the file /Admin/DeleteUser.php allows SQL injection. Remote exploitation is possible and the exploit has been publicly released.
- CVE-2026-15675High
A SQL Injection vulnerability was found in Online Job Portal 1.0 in the file /Admin/EditUser.php. An attacker can remotely manipulate the UserId argument, leading to SQL injection. The exploit is publicly available.
- CVE-2026-14660High
A SQL injection vulnerability was found in Online Job Portal 1.0 in the login.php file. Manipulating the txtUser or txtPass arguments allows remote execution of unauthorized database queries. The exploit has been published, increasing the attack risk.
Original NVD description (English source)
A weakness has been identified in code-projects Online Job Portal 1.0. This affects an unknown function of the file /JobSeekerInsert.php. Executing a manipulation of the argument txtFile can lead to unrestricted upload. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.