Description
A vulnerability has been found in code-projects Online Job Portal System 1.0. The impacted element is an unknown function of the file /ForPass.php of the component Password Recovery. Such manipulation of the argument txtUserName leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Published: 2026-08-19
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in ForPass.php of the Online Job Portal System and allows an attacker to inject arbitrary SQL through the txtUserName parameter. This flaw is a classic SQL injection (CWE‑74/CWE‑89) that can compromise the confidentiality and integrity of the database and potentially lead to data tampering or disclosure. The impact is limited to the data returned by the affected query, but a successful exploitation could expose or modify sensitive user information stored within the portal database.

Affected Systems

Affected product: code‑projects Online Job Portal System version 1.0. No patch version is listed. The flaw is present in the password recovery component and can be reached via the remote web interface.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack is remote and leverages direct user input to manipulate the SQL query. Given that the exploit has been disclosed publicly and may be used, the risk is non‑negligible and warrants timely remediation.

Generated by OpenCVE AI on August 19, 2026 at 06:56 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Acquire and deploy the official patch or upgraded release from the vendor.
  • Refactor the ForPass.php code to use prepared statements or parameterized queries, eliminating direct concatenation of user input.
  • If no patch is available, disable or restrict access to the password recovery feature until the code is secured.

Generated by OpenCVE AI on August 19, 2026 at 06:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 25 Aug 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 02:00:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in code-projects Online Job Portal System 1.0. The impacted element is an unknown function of the file /ForPass.php of the component Password Recovery. Such manipulation of the argument txtUserName leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Title code-projects Online Job Portal System Password Recovery ForPass.php sql injection
First Time appeared Code-projects
Code-projects online Job Portal System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:code-projects:online_job_portal_system:*:*:*:*:*:*:*:*
Vendors & Products Code-projects
Code-projects online Job Portal System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Online Job Portal System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-25T01:48:47.009Z

Reserved: 2026-08-18T18:29:03.155Z

Link: CVE-2026-75986

cve-icon Vulnrichment

Updated: 2026-08-25T01:48:42.225Z

cve-icon NVD

Status : Deferred

Published: 2026-08-19T02:16:12.993

Modified: 2026-08-25T03:16:57.210

Link: CVE-2026-75986

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-19T12:45:03Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')