CVE-2026-7028
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
In CodeAstro Online Job Portal 1.0, manipulation of the ID argument in /admin/jobs-admins/delete-jobs.php leads to SQL injection. The attack can be carried out remotely and a public exploit has been released.
Risk Assessment
A remote attacker can exploit the SQL injection for unauthorized database operations, and the public exploit increases the likelihood of exploitation.
Recommendation
Restrict access to the admin panel, enforce parameterized SQL queries and input validation, and update or replace the vulnerable component.
Other vulnerabilities in CodeAstro Online Job Portal
See all- CVE-2026-77681Medium
A vulnerability was identified in CodeAstro Online Job Portal 1.0 in the file /users/update-profile.php. Manipulation of the Name argument leads to unrestricted upload. The attack can be initiated remotely, and the exploit is publicly available.
- CVE-2026-10261High
A SQL injection vulnerability was found in CodeAstro Online Job Portal 1.0 in the file /users/application_status.php. Manipulating the ID argument can lead to unauthorized database access. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-10260High
A SQL injection vulnerability was found in CodeAstro Online Job Portal 1.0 in the file /admin/jobs-admins/delete-jobs.php. Manipulating the ID argument can lead to unauthorized database access. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-7071Medium
In CodeAstro Online Job Portal 1.0, an unknown functionality of /users/user-cvs/ leads to file and directory information exposure. Remote exploitation is possible and the exploit has been publicly disclosed.
- CVE-2026-6201Medium
A vulnerability was identified in CodeAstro Online Job Portal 1.0 in an unknown function of /jobs/job-delete.php within the Delete Job Posting Handler component. Manipulation of the ID argument leads to improper access controls, and the attack can be launched remotely.
Original NVD description (English source)
A security flaw has been discovered in CodeAstro Online Job Portal 1.0. The affected element is an unknown function of the file /admin/jobs-admins/delete-jobs.php of the component All Jobs Page. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS