CVE-2026-77681
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
A vulnerability was identified in CodeAstro Online Job Portal 1.0 in the file /users/update-profile.php. Manipulation of the Name argument leads to unrestricted upload. The attack can be initiated remotely, and the exploit is publicly available.
Risk Assessment
Risk of uploading malicious files to the server, potentially leading to code execution or application takeover.
Recommendation
Restrict allowed file types and validate content, and apply vendor patches if available.
Other vulnerabilities in CodeAstro Online Job Portal
See all- CVE-2026-10261High
A SQL injection vulnerability was found in CodeAstro Online Job Portal 1.0 in the file /users/application_status.php. Manipulating the ID argument can lead to unauthorized database access. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-10260High
A SQL injection vulnerability was found in CodeAstro Online Job Portal 1.0 in the file /admin/jobs-admins/delete-jobs.php. Manipulating the ID argument can lead to unauthorized database access. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-7071Medium
In CodeAstro Online Job Portal 1.0, an unknown functionality of /users/user-cvs/ leads to file and directory information exposure. Remote exploitation is possible and the exploit has been publicly disclosed.
- CVE-2026-7028Medium
In CodeAstro Online Job Portal 1.0, manipulation of the ID argument in /admin/jobs-admins/delete-jobs.php leads to SQL injection. The attack can be carried out remotely and a public exploit has been released.
- CVE-2026-6201Medium
A vulnerability was identified in CodeAstro Online Job Portal 1.0 in an unknown function of /jobs/job-delete.php within the Delete Job Posting Handler component. Manipulation of the ID argument leads to improper access controls, and the attack can be launched remotely.
Original NVD description (English source)
A vulnerability was identified in CodeAstro Online Job Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /users/update-profile.php. The manipulation of the argument Name leads to unrestricted upload. The attack can be initiated remotely. The exploit is publicly available and might be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS