Description
A vulnerability was identified in code-projects Online Job Portal 1.0. The affected element is an unknown function of the file /Admin/EditUser.php. Such manipulation of the argument UserId leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.
Published: 2026-07-14
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability originates from an unvalidated UserId parameter in the Admin/EditUser.php module, enabling attackers to inject arbitrary SQL commands. Classified as CWE-74 and CWE-89, this flaw can lead to unauthorized data tampering or extraction.

Affected Systems

Affected is code-projects Online Job Portal version 1.0, particularly the /Admin/EditUser.php script accessed via web requests. Only this version is known to contain the flaw.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity, while an EPSS score of less than 1% suggests low current exploitation likelihood. The flaw can be triggered remotely through crafted UserId inputs, and public exploits are available, though the portal is not listed in CISA’s KEV catalog. The risk remains until an official update is applied or mitigation measures are implemented.

Generated by OpenCVE AI on July 31, 2026 at 10:47 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Check the vendor's website or GitHub repository for security updates or patches related to EditUser.php.
  • Restrict access to /Admin/EditUser.php so that only authenticated administrators can invoke it.
  • Implement input validation, use prepared statements or parameterized queries to eliminate SQL injection risk.

Generated by OpenCVE AI on July 31, 2026 at 10:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 14 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 14 Jul 2026 06:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in code-projects Online Job Portal 1.0. The affected element is an unknown function of the file /Admin/EditUser.php. Such manipulation of the argument UserId leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.
Title code-projects Online Job Portal EditUser.php sql injection
First Time appeared Code-projects
Code-projects online Job Portal
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:code-projects:online_job_portal:*:*:*:*:*:*:*:*
Vendors & Products Code-projects
Code-projects online Job Portal
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Online Job Portal
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-14T14:30:22.483Z

Reserved: 2026-07-13T21:19:09.499Z

Link: CVE-2026-15675

cve-icon Vulnrichment

Updated: 2026-07-14T13:01:33.359Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T11:00:06Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')