EUVD-2026-43630
GHSA-29gr-w86r-vj34
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network access (AV:N/PR:N), webshell upload yields OS-level code execution crossing application boundary (S:C), enabling full C/I/A compromise of the hosting server.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in code-projects Online Job Portal 1.0. This affects an unknown function of the file /JobSeekerInsert.php. Executing a manipulation of the argument txtFile can lead to unrestricted upload. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
AnalysisAI
Unrestricted file upload in code-projects Online Job Portal 1.0 exposes unauthenticated remote attackers to arbitrary file upload via the txtFile parameter in /JobSeekerInsert.php, enabling likely webshell deployment and subsequent server-side code execution. A public proof-of-concept exploit exists (no KEV listing), substantially lowering the exploitation barrier for any internet-exposed instance. The CVSS 4.0 impact metrics are conservatively rated Low across C/I/A, which understates the realistic post-exploitation potential of an unrestricted PHP file upload - successful webshell placement typically yields full OS command execution in the web server process context.
Technical ContextAI
Online Job Portal 1.0 is a PHP-based web application from code-projects (CPE: cpe:2.3:a:code-projects:online_job_portal:*:*:*:*:*:*:*:*), likely used for resume or document submission by job seekers. The vulnerability class is CWE-434 (Unrestricted Upload of File with Dangerous Type), indicating the endpoint /JobSeekerInsert.php accepts multipart file uploads via the txtFile argument without adequately validating the submitted file's extension, MIME type, or content. In PHP environments, this failure allows an attacker to submit a .php webshell disguised as or directly as the upload payload. If the upload destination is within the web root and the server executes PHP, the attacker can subsequently browse to the stored file and trigger arbitrary OS command execution. The wildcard CPE version (*) indicates the vulnerable version boundary has not been formally scoped beyond version 1.0.
RemediationAI
No vendor-released patch has been identified at time of analysis; fix version is unknown and unconfirmed. As an immediate compensating control, restrict public HTTP access to /JobSeekerInsert.php at the web server or WAF layer - this blocks the attack entirely but may disable job seeker registration functionality. If the endpoint must remain available, implement strict server-side file type validation using a whitelist of safe extensions (e.g., .pdf, .doc, .docx) and validate MIME type independently of the client-supplied Content-Type header. Store uploaded files outside the web root or in a directory configured to deny PHP execution (e.g., via .htaccess or Nginx location block with 'deny' for script execution) so that even successfully uploaded webshells cannot be invoked. Rename uploaded files on the server side to strip any executable extension. Monitor the upload storage path for unexpected .php or .phtml files. Track VulDB advisory https://vuldb.com/vuln/378167 and the POC at https://github.com/shihuizhang-dazhi/MY-CVE/issues/6 for patch availability updates.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today