The vulnerability is located in the update-profile.php file of CodeAstro Online Job Portal 1.0. The Name parameter can be manipulated to upload files without any form of validation. Attackers can therefore place arbitrary files on the server, including potentially executable web shells. If the uploaded file is executed, this flaw could lead to remote code execution. The weakness is an arbitrary file upload that bypasses type checks, exposing a classic web‑application security gap.

The affected product is CodeAstro Online Job Portal, at version 1.0. This specific flaw resides within the update-profile.php script that handles user profile updates. No other versions or products are listed as affected in the available data.

The CVSS score of 5.3 indicates a moderate severity for this flaw. No EPSS score is available, and the vulnerability is not listed in the KEV catalog, suggesting it has not yet been widely observed in the wild. However, the exploit is publicly available and can be triggered remotely by crafting a malicious Name argument. Because the file upload is unrestricted, attackers can upload web shells or other malicious payloads, enabling remote code execution or further compromise. The lack of file‑type validation and directory execution restrictions makes exploitation straightforward for an attacker with access to the application URL.