The vulnerability is a classic SQL injection flaw in an unknown function within DeleteUser.php of the Admin module. An attacker can alter the SQL query to access or modify database records, potentially exposing sensitive data or deleting user accounts. The flaw falls under CWE-74 and CWE-89, indicating unsafe construction of SQL statements from user input. Remote exploitation is possible, so an attacker can trigger the injection from outside the host.

Vendor: code-projects. Product: Online Job Portal. Affected release: version 1.0 and all prior releases.

The CVSS score of 6.9 reflects a moderate severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation under current conditions. The vulnerability is not listed in the CISA KEV catalog, meaning there is no confirmed widespread exploitation yet. The likely attack vector is a remote HTTP request to /Admin/DeleteUser.php that includes malicious input; because the application does not properly sanitize or parameterize user data, the attacker can inject arbitrary SQL statements.