CVE-2026-10261
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A SQL injection vulnerability was found in CodeAstro Online Job Portal 1.0 in the file /users/application_status.php. Manipulating the ID argument can lead to unauthorized database access. The attack can be performed remotely and the exploit is publicly available.
Risk Assessment
An attacker can gain unauthorized access to sensitive data in the database, potentially leading to leakage of user and job listing information.
Recommendation
Immediately update the system to the latest version or apply a patch that prevents SQL injection, such as using prepared statements.
Other vulnerabilities in CodeAstro Online Job Portal
See all- CVE-2026-77681Medium
A vulnerability was identified in CodeAstro Online Job Portal 1.0 in the file /users/update-profile.php. Manipulation of the Name argument leads to unrestricted upload. The attack can be initiated remotely, and the exploit is publicly available.
- CVE-2026-10260High
A SQL injection vulnerability was found in CodeAstro Online Job Portal 1.0 in the file /admin/jobs-admins/delete-jobs.php. Manipulating the ID argument can lead to unauthorized database access. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-7071Medium
In CodeAstro Online Job Portal 1.0, an unknown functionality of /users/user-cvs/ leads to file and directory information exposure. Remote exploitation is possible and the exploit has been publicly disclosed.
- CVE-2026-7028Medium
In CodeAstro Online Job Portal 1.0, manipulation of the ID argument in /admin/jobs-admins/delete-jobs.php leads to SQL injection. The attack can be carried out remotely and a public exploit has been released.
- CVE-2026-6201Medium
A vulnerability was identified in CodeAstro Online Job Portal 1.0 in an unknown function of /jobs/job-delete.php within the Delete Job Posting Handler component. Manipulation of the ID argument leads to improper access controls, and the attack can be launched remotely.
Original NVD description (English source)
A flaw has been found in CodeAstro Online Job Portal 1.0. This affects an unknown function of the file /users/application_status.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS