Online Job Portal CVE-2026-15675

The vulnerable code path is the UserId parameter in HTTP requests to /Admin/EditUser.php. The CVSS 4.0 vector specifies PR:N (no privileges required), implying the admin panel endpoint is network-accessible without prior authentication; however, the /Admin/ path strongly suggests an admin login is normally expected - whether that gate is actually enforced in code-projects' implementation is not confirmed by available data, and defenders should verify this directly. No special configuration, non-default feature flag, or specific platform version is cited as a prerequisite beyond running the affected application on a PHP/MySQL stack. Exploitation is limited in practice if: (1) the application is deployed only on internal/private networks, (2) admin panel access is IP-restricted, or (3) the application enforces session authentication before serving EditUser.php. The wildcard CPE version means no version-specific scoping applies - any deployed copy is presumed affected.

The CVSS 4.0 base score of 5.5 (Medium) reflects limited per-impact severity (VC:L/VI:L/VA:L) across all three CIA dimensions, but the exploit maturity modifier E:P confirms a public proof-of-concept exists, raising practical risk above what the base score alone suggests. The AV:N/AC:L/AT:N/PR:N/UI:N metrics indicate zero-friction remote exploitation under default conditions - no attacker prerequisites other than network reachability. However, there is a notable tension: the vulnerable file resides under /Admin/, which in a typical web application implies an authenticated administrative session is required. If the admin panel enforces authentication, then PR:N is misleading and actual exploitation requires credential theft or bypass first. This discrepancy is not resolved by available data and should be verified against the application's actual authentication flow. No EPSS score was provided in the input data. The absence of a CISA KEV listing suggests no confirmed mass exploitation at time of analysis, though the public POC lowers the barrier significantly for opportunistic scanning of exposed instances.

An attacker identifies a publicly reachable instance of Online Job Portal 1.0 by scanning for the /Admin/EditUser.php path - a trivial step given the application's open-source distribution. The attacker appends a SQL injection payload to the UserId parameter (e.g., a UNION SELECT statement) in a crafted HTTP request, causing the backend query to return or modify database records including user credentials and job seeker data. With a public exploit already available on GitHub, this requires minimal technical skill and can be executed by script-level actors.