Is there a public PoC exploit available for CVE-2026-14660?

Yes, a public proof-of-concept exploit is available for CVE-2026-14660. Prioritise patching immediately. EPSS: 0.4%.

Online Job Portal CVE-2026-14660

Q: What is the CVSS score of CVE-2026-14660?

CVE-2026-14660 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-41704 MEDIUM

SQL Injection (CWE-89)

2026-07-04 VulDB

GHSA-mv94-jj83-xmx4

PHP SQLi Online Job Portal Code Projects

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Login form is network-accessible with no privileges or interaction required; impact capped at partial given limited scope and no scope change evident.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 04, 2026 - 23:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jul 04, 2026 - 23:21 vuln.today

DescriptionCVE.org

A vulnerability was found in code-projects Online Job Portal 1.0. The affected element is an unknown function of the file login.php. Performing a manipulation of the argument txtUser/txtPass results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used.

AnalysisAI

SQL injection in code-projects Online Job Portal 1.0 exposes the login.php endpoint to remote unauthenticated exploitation via the txtUser and txtPass parameters, enabling attackers to manipulate backend SQL queries without any credentials or user interaction. A public proof-of-concept exploit is documented on GitHub, significantly lowering the barrier to attack for any internet-exposed instance. No patch has been identified from the vendor at time of analysis; the wildcard CPE suggests all versions are affected.

Technical ContextAI

The vulnerability is a CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) in the PHP-based login form of Online Job Portal 1.0, confirmed by CPE cpe:2.3:a:code-projects:online_job_portal:*:*:*:*:*:*:*:*. The login.php script passes the txtUser and txtPass POST parameters directly into SQL query construction without sanitization or parameterized query usage, allowing injected SQL syntax to alter query semantics. This is a well-understood vulnerability class in PHP applications where raw user input is concatenated into database queries. The wildcard version in the CPE indicates no version boundary has been established, implying the flaw likely spans the entire release history of this project.

RemediationAI

No vendor-released patch has been identified at the time of analysis. The primary remediation is to refactor login.php to replace string-concatenated SQL queries with parameterized queries or prepared statements (e.g., PDO with bindParam), which structurally eliminates the injection vector. As an interim compensating control, deploying a web application firewall with SQL injection detection rules (e.g., ModSecurity CRS) can reduce opportunistic exploitation risk, though WAF bypass remains possible for a determined attacker. If the application is not required to be publicly accessible, restricting the login.php endpoint to known IP ranges via server-level access controls (e.g., Apache Allow/Deny or nginx geo module) provides the most reliable mitigation with minimal side effects. Disabling the application entirely until patched is advised for any internet-facing deployment. The VulDB advisory is available at https://vuldb.com/vuln/376174 and the public exploit documentation is at https://github.com/aiyuyuyu/cve/blob/main/job_portal_sql.md.