Online Job Portal CVE-2026-15676

Exploitation requires the target Online Job Portal instance to be network-accessible and that the /Admin/DeleteUser.php endpoint be reachable by the attacker. The CVSS 4.0 vector specifies PR:N (no privileges required) and UI:N (no user interaction), suggesting the endpoint may be reachable without authentication; however, the /Admin/ path prefix is a concrete indicator that an authentication gate may exist in some deployments - if so, valid admin credentials would be a prerequisite. No special non-default configuration is described as required beyond a running installation. Exploitation is limited by: (1) whether the admin panel enforces authentication in the specific deployment, (2) network accessibility of the admin interface, and (3) the PHP application being actively hosted and not behind a reverse proxy with path restrictions.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) assigns no privileges required and no attack complexity, indicating exploitation is trivially automated against any network-accessible instance. However, the endpoint path /Admin/DeleteUser.php raises a notable inconsistency: admin-prefixed paths frequently sit behind authentication, which would raise the realistic exploitation bar beyond what PR:N implies - this conflict is not resolved by available data and should be verified against the application's actual access controls. CVSS 4.0 base score is 5.5 (Medium), with confidentiality, integrity, and availability impacts each rated Low. The E:P (proof-of-concept) supplemental metric confirms public exploit code exists, elevating practical risk above the moderate base score. EPSS data is not provided. No KEV listing means confirmed in-the-wild exploitation is not established. The primary risk is opportunistic targeting of exposed instances, particularly since the POC is publicly indexed.

An attacker identifies a publicly accessible Online Job Portal instance via search engine dorking or automated scanning targeting the /Admin/DeleteUser.php path. Using the published proof-of-concept on GitHub (shihuizhang-dazhi/MY-CVE/issues/4), the attacker crafts an HTTP request with a malicious SQL payload in the user identifier parameter, extracting credentials or other sensitive database contents - or deleting user records - without requiring prior authentication if the admin panel lacks access controls.