Is there a public PoC exploit available for EUVD-2026-25703?

Yes, a public proof-of-concept exploit is available for EUVD-2026-25703. Prioritise patching immediately. EPSS: 0.0%.

CodeAstro Online Job Portal EUVD-2026-25703

Q: What is the CVSS score of EUVD-2026-25703?

EUVD-2026-25703 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-7028 LOW

SQL Injection (CWE-89)

2026-04-26 VulDB

PHP SQLi

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.1 (MEDIUM) 2.0 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

CVSS changed

Apr 26, 2026 - 09:22 NVD

4.7 (MEDIUM) 5.1 (MEDIUM)

Analysis Generated

Apr 26, 2026 - 09:15 vuln.today

EUVD ID Assigned

Apr 26, 2026 - 09:00 euvd

EUVD-2026-25703

Analysis Generated

Apr 26, 2026 - 09:00 vuln.today

CVE Published

Apr 26, 2026 - 08:45 nvd

LOW 2.0

DescriptionCVE.org

A security flaw has been discovered in CodeAstro Online Job Portal 1.0. The affected element is an unknown function of the file /admin/jobs-admins/delete-jobs.php of the component All Jobs Page. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in CodeAstro Online Job Portal 1.0 allows authenticated admin users to manipulate the ID parameter in /admin/jobs-admins/delete-jobs.php, enabling remote SQL injection attacks against the database. The vulnerability requires high-level admin privileges (PR:H) but has a publicly available exploit and low attack complexity (AC:L), permitting remote attackers with admin access to read, modify, or delete sensitive database records. Exploitation is confirmed by public proof-of-concept code.

Technical ContextAI

CodeAstro Online Job Portal is a PHP-based job management system vulnerable to SQL injection (CWE-89) in its admin panel. The vulnerable endpoint /admin/jobs-admins/delete-jobs.php fails to properly sanitize or parameterize the ID parameter before incorporating it into SQL queries. This allows attackers with admin credentials to craft malicious SQL statements that execute arbitrary database commands. The vulnerability is rooted in improper input validation and the use of string concatenation or direct variable interpolation in SQL construction rather than prepared statements or parameterized queries, a common flaw in PHP applications lacking modern security practices.

RemediationAI

Immediately apply input validation and parameterized queries to the /admin/jobs-admins/delete-jobs.php endpoint by rewriting the delete function to use prepared statements with bound parameters instead of string concatenation. If a vendor patch is available from CodeAstro, upgrade to the patched version immediately. As a compensating control pending patch deployment, restrict access to the /admin/jobs-admins/ directory to a whitelist of trusted IP addresses or require additional multi-factor authentication for admin panel access. Audit admin account activity logs to identify any suspicious deletion patterns or unauthorized database modifications. Database-level mitigations include restricting the database user account powering the application to least-privilege permissions (read-only where deletion is not required, or DELETE-only on specific tables). These controls introduce minimal functional impact but may slow legitimate admin workflows; assess and document any performance or usability trade-offs during implementation.