Is there a public PoC exploit available for CVE-2026-15676?

Yes, a public proof-of-concept exploit is available for CVE-2026-15676. Prioritise patching immediately. EPSS: 0.3%.

Online Job Portal CVE-2026-15676

Q: What is the CVSS score of CVE-2026-15676?

CVE-2026-15676 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-43629 MEDIUM

SQL Injection (CWE-89)

2026-07-14 VulDB

GHSA-ghc7-7vj6-mgxq

PHP SQLi Online Job Portal Code Projects

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-reachable endpoint, low complexity SQL injection; PR:N per provided vector though /Admin/ path suggests authentication may apply in practice.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 06:31 vuln.today

CVSS changed

Jul 14, 2026 - 06:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

CVE Published

Jul 14, 2026 - 06:00 cve.org

MEDIUM 5.5

DescriptionCVE.org

A security flaw has been discovered in code-projects Online Job Portal up to 1.0. The impacted element is an unknown function of the file /Admin/DeleteUser.php. Performing a manipulation results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in code-projects Online Job Portal 1.0 exposes the /Admin/DeleteUser.php endpoint to unauthenticated remote database manipulation. An attacker can craft HTTP requests that inject arbitrary SQL, enabling data extraction, modification, or deletion from the underlying database. A public proof-of-concept exploit exists (GitHub: shihuizhang-dazhi/MY-CVE/issues/4), lowering the bar for exploitation; this vulnerability is not currently listed in CISA KEV.

Technical ContextAI

The affected product is a PHP-based web application distributed by code-projects (CPE: cpe:2.3:a:code-projects:online_job_portal:*:*:*:*:*:*:*:*). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input is passed directly to a database query in /Admin/DeleteUser.php without adequate sanitization or parameterized query usage. PHP applications that construct SQL queries via string concatenation are a classic and well-understood attack surface. The DeleteUser functionality suggests the vulnerable parameter is likely a user identifier passed to a DELETE or SELECT statement.

RemediationAI

No vendor-released patch or fixed version has been identified at the time of analysis. The codebase should be remediated by replacing string-concatenated SQL queries in /Admin/DeleteUser.php with parameterized queries or prepared statements (e.g., PDO with bindParam), which is the only definitive fix for CWE-89. As a compensating control, restrict network access to the /Admin/ directory via web server configuration (e.g., Apache .htaccess IP allowlist or nginx location block) to limit exposure to trusted administrative networks only - this reduces attack surface but does not eliminate the flaw if the admin panel is legitimately internet-exposed. Input validation (allowlisting expected ID formats) can add a secondary layer but should not be treated as a primary defense. Deploying a web application firewall (WAF) rule to detect and block SQL injection patterns is an additional control with low operational overhead. See VulDB advisory: https://vuldb.com/vuln/378166.