Description
A vulnerability was found in code-projects Online Job Portal 1.0. The affected element is an unknown function of the file login.php. Performing a manipulation of the argument txtUser/txtPass results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used.
Published: 2026-07-04
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The login.php handler in code‑projects Online Job Portal 1.0 fails to sanitise the txtUser and txtPass parameters, allowing an attacker to inject arbitrary SQL statements. This flaw, identified as CWE‑74 and CWE‑89, can be exploited remotely via the web interface.

Affected Systems

Version 1.0 of the code‑projects Online Job Portal is affected, and no other releases or products are listed as vulnerable.

Risk and Exploitability

The CVSS score of 6.9 places this flaw in the moderate severity range, while the EPSS score of less than 1% indicates a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, further reducing the likelihood of widespread attacks. Nevertheless, an attacker who can reach the publicly exposed login page could submit malicious credentials to execute arbitrary SQL commands.

Generated by OpenCVE AI on July 24, 2026 at 09:47 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Online Job Portal to a patched or newer release where the login.php SQL injection flaw has been fixed.
  • Modify the authentication code to use parameterized queries or prepared statements so that user‑supplied input is treated as data, not executable SQL.
  • Configure the database account used by the application with the least privileges required for authentication, preventing the execution of unauthorized data‑modifying commands.

Generated by OpenCVE AI on July 24, 2026 at 09:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 04 Jul 2026 22:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in code-projects Online Job Portal 1.0. The affected element is an unknown function of the file login.php. Performing a manipulation of the argument txtUser/txtPass results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used.
Title code-projects Online Job Portal login.php sql injection
First Time appeared Code-projects
Code-projects online Job Portal
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:code-projects:online_job_portal:*:*:*:*:*:*:*:*
Vendors & Products Code-projects
Code-projects online Job Portal
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Online Job Portal
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-06T17:41:03.762Z

Reserved: 2026-07-03T18:53:30.359Z

Link: CVE-2026-14660

cve-icon Vulnrichment

Updated: 2026-07-06T17:40:55.278Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-24T10:00:04Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')