CodeAstro Online Job Portal CVE-2026-10261

Q: What is the CVSS score of CVE-2026-10261?

CVE-2026-10261 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33643 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-06-01 cna@vuldb.com

GHSA-4wg9-whp4-33cj

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 01, 2026 - 15:36 vuln.today

DescriptionCVE.org

A flaw has been found in CodeAstro Online Job Portal 1.0. This affects an unknown function of the file /users/application_status.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used.

AnalysisAI

SQL injection in CodeAstro Online Job Portal 1.0 exposes the /users/application_status.php endpoint to unauthenticated remote attackers who can manipulate the ID parameter to inject arbitrary SQL into backend database queries, resulting in partial confidentiality, integrity, and availability impact. A proof-of-concept exploit has been published (CVSS 4.0 E:P confirmed), lowering the barrier to exploitation significantly despite the medium overall score. No public KEV listing exists, meaning active widespread exploitation is not confirmed at time of analysis, but the combination of a public POC and zero authentication requirements makes this a credible near-term risk for any internet-exposed deployment.

Technical ContextAI

CodeAstro Online Job Portal 1.0 is a PHP-based web application (tag: PHP) that processes job application status lookups via the /users/application_status.php script. The ID parameter accepted by this endpoint is passed to a downstream SQL query without adequate sanitization or use of parameterized statements, constituting a classic injection flaw. The root cause class is CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - Injection), which is the parent category encompassing CWE-89 (SQL Injection) as confirmed by the SQLi tag. No CPE strings were included in the provided data, so affected version scope is limited to what VulDB documents for version 1.0. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N reflects a fully network-exploitable endpoint requiring no authentication, no user interaction, and no complex preconditions, consistent with a publicly accessible PHP web form querying a relational database.

RemediationAI

No vendor-released patch has been identified in the available data - no fix version is documented in the VulDB submission, references, or any vendor advisory. The primary remediation is to replace the vulnerable dynamic SQL construction in /users/application_status.php with parameterized queries or prepared statements using PHP's PDO or MySQLi extensions, which eliminates the SQL injection root cause entirely. As a compensating control until a code fix is applied, administrators should deploy a web application firewall (WAF) rule set targeting SQL injection patterns on the /users/application_status.php endpoint - note that WAF bypass techniques exist and this is not a permanent fix. Additionally, restricting access to the application_status.php endpoint to authenticated sessions only (if the application architecture permits) would raise the attacker bar from PR:N to PR:L, substantially reducing exploitability. Database privilege minimization (ensuring the application database user has only SELECT on required tables) can limit the blast radius of a successful injection. References: VulDB entry at https://vuldb.com/vuln/367541 and POC at https://github.com/6Justdododo6/CVE/issues/19.