CVE-2026-15678
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A security vulnerability has been detected in code-projects Online Job Portal 1.0. An unknown function in the file /Admin/DetailJob.php leads to cross-site scripting (XSS). The attack can be carried out remotely, and the exploit has been publicly disclosed.
Risk Assessment
The risk involves an attacker injecting malicious scripts, potentially leading to session hijacking, redirects, or theft of administrative credentials.
Recommendation
Immediately update the system to the latest version or apply a security patch. If unavailable, temporarily disable access to /Admin/DetailJob.php or implement input filtering.
Other vulnerabilities in Online Job Portal
See all- CVE-2026-15677High
A vulnerability has been found in Online Job Portal 1.0, allowing unrestricted file upload via the txtFile argument in /JobSeekerInsert.php. The attack can be performed remotely, and a public exploit is available.
- CVE-2026-15676High
A security flaw was discovered in code-projects Online Job Portal up to version 1.0. An unknown function in the file /Admin/DeleteUser.php allows SQL injection. Remote exploitation is possible and the exploit has been publicly released.
- CVE-2026-15675High
A SQL Injection vulnerability was found in Online Job Portal 1.0 in the file /Admin/EditUser.php. An attacker can remotely manipulate the UserId argument, leading to SQL injection. The exploit is publicly available.
- CVE-2026-14660High
A SQL injection vulnerability was found in Online Job Portal 1.0 in the login.php file. Manipulating the txtUser or txtPass arguments allows remote execution of unauthorized database queries. The exploit has been published, increasing the attack risk.
Original NVD description (English source)
A security vulnerability has been detected in code-projects Online Job Portal 1.0. This impacts an unknown function of the file /Admin/DetailJob.php. The manipulation leads to cross site scripting. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS