Online Job Portal CVE-2026-75986

No authentication is required - the vulnerable /ForPass.php endpoint is part of the public-facing Password Recovery feature and is accessible to any unauthenticated HTTP client by design. The specific condition is that the Online Job Portal System 1.0 must be deployed and the Password Recovery feature must be reachable over the network (HTTP or HTTPS). No special configuration, non-default settings, or administrative access are needed. Exploitation is bounded by product deployment: the attacker must target a server running this specific PHP application. There is no known limitation based on operating system or database backend beyond the application's own PHP and SQL environment.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a low-complexity, remote, unauthenticated attack with no user interaction, which represents a favorable exploitation profile for attackers. The scored impact (VC:L/VI:L/VA:L) is classified as low across all dimensions, and the E:P modifier acknowledges the public proof-of-concept. No EPSS probability score was supplied in the available data, and CISA KEV listing has not been confirmed, so the breadth of active exploitation remains unknown beyond the PoC disclosure. The low impact scores may understate actual risk: SQL injection in a job portal backend can expose applicant PII, employer credentials, and session tokens depending on database schema, and even a mid-sized municipal IT team in zabrze that deployed this portal would need to treat this as urgent given the pre-auth nature and the public exploit. The primary risk limiter is prevalence - this is a niche, open-source PHP demo project with a small production footprint - meaning aggregate exposure is constrained even though per-instance exploitability is high.

An unauthenticated attacker identifies a publicly accessible Online Job Portal System 1.0 instance, navigates to the /ForPass.php password recovery page, and submits a crafted txtUserName value containing a UNION-based or boolean-based SQL payload. The PHP backend injects this unsanitized value directly into a database query, enabling the attacker to enumerate table structures and extract usernames, hashed passwords, and applicant PII from the underlying database. A working proof-of-concept is publicly available at https://github.com/niaoniaollll/cve/issues/7, significantly lowering the technical bar for exploitation.