CVE-2026-77681
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A vulnerability was identified in CodeAstro Online Job Portal 1.0 in the file /users/update-profile.php. Manipulation of the Name argument leads to unrestricted upload. The attack can be initiated remotely, and the exploit is publicly available.
Risk Assessment
Risk of uploading malicious files to the server, potentially leading to code execution or application takeover.
Recommendation
Restrict allowed file types and validate content, and apply vendor patches if available.
Other vulnerabilities in CodeAstro Online Job Portal
See all- CVE-2026-10261High
A SQL injection vulnerability was found in CodeAstro Online Job Portal 1.0 in the file /users/application_status.php. Manipulating the ID argument can lead to unauthorized database access. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-10260High
A SQL injection vulnerability was found in CodeAstro Online Job Portal 1.0 in the file /admin/jobs-admins/delete-jobs.php. Manipulating the ID argument can lead to unauthorized database access. The attack can be performed remotely and the exploit is publicly available.
Original NVD description (English source)
A vulnerability was identified in CodeAstro Online Job Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /users/update-profile.php. The manipulation of the argument Name leads to unrestricted upload. The attack can be initiated remotely. The exploit is publicly available and might be used.