A vulnerability in CodeAstro Online Job Portal allows the /users/user-cvs/ directory to expose file and directory listings, resulting in the disclosure of user CV information and potentially other sensitive data. This flaw is associated with CWE-200 (Information Exposure) and CWE-538 (Sensitive Data Exposure). The vulnerability can be exploited from remote locations, and the exploit has already been publicly disclosed, indicating that attackers could easily use it to discover files that should remain private.

The affected product is CodeAstro Online Job Portal version 1.0. No other vendors or product versions are listed in the CNA data.

The vulnerability is scored as a 6.9 on the CVSS scale, indicating moderate severity. Its EPSS score is below 1%, suggesting a very low probability of exploitation in the short term. The flaw is not listed in the CISA KEV catalog. The attack vector is remote, likely unauthenticated, and involves accessing a publicly reachable directory that should be protected, making exploitation straightforward for an attacker who can reach the web server.