CodeAstro Job Portal CVE-2026-10260

Q: What is the CVSS score of CVE-2026-10260?

CVE-2026-10260 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33639 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-06-01 cna@vuldb.com

GHSA-w973-cgqm-7v2w

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 01, 2026 - 15:36 vuln.today

DescriptionCVE.org

A vulnerability was detected in CodeAstro Online Job Portal 1.0. The impacted element is an unknown function of the file /admin/jobs-admins/delete-jobs.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

AnalysisAI

SQL injection in CodeAstro Online Job Portal 1.0 exposes the /admin/jobs-admins/delete-jobs.php endpoint to remote database manipulation via an unsanitized ID parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates no authentication, no complexity, and no user interaction are required to exploit this flaw from the network, though the admin panel context of the vulnerable endpoint warrants verification of actual auth enforcement. Publicly available exploit code exists (E:P), elevating practical risk above what the medium CVSS score of 5.5 alone might suggest.

Technical ContextAI

CodeAstro Online Job Portal 1.0 is a PHP-based web application available from codeastro.com. The vulnerable file /admin/jobs-admins/delete-jobs.php handles job record deletion and accepts an ID parameter that is passed into SQL queries without adequate sanitization or use of parameterized statements. The root cause class is CWE-74 (Injection), specifically SQL injection - a failure to neutralize special characters in user-controlled input before it is interpreted by a downstream SQL engine. No CPE string was provided in the source data, so affected product scope is limited to what the description and vendor site confirm: version 1.0 of this PHP application.

RemediationAI

No vendor-released patch or fixed version has been identified at time of analysis. The primary remediation is to replace direct SQL string concatenation in /admin/jobs-admins/delete-jobs.php with parameterized queries or prepared statements using PHP's PDO or MySQLi interfaces, which eliminates the injection surface entirely. As a compensating control, restrict network-level access to all /admin/ paths via web server configuration (e.g., IP allowlisting or HTTP basic auth at the server layer) to reduce the exposure of the admin panel to untrusted networks - note this does not fix the underlying vulnerability but limits who can attempt exploitation. Input validation (whitelisting numeric-only values for the ID parameter) provides an additional defense layer but should not be treated as a primary fix. The public exploit reference is available at https://github.com/6Justdododo6/CVE/issues/18 and the VulDB entry at https://vuldb.com/vuln/367540.