High severity · published Jul 14, 2026
CVE-2026-15677
code-projects Online Job Portal JobSeekerInsert.php unrestricted upload
7.3
CVSS
0.5%
EPSS
No
On KEV
Description
A weakness has been identified in code-projects Online Job Portal 1.0. This affects an unknown function of the file /JobSeekerInsert.php. Executing a manipulation of the argument txtFile can lead to unrestricted upload. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OJ
Online Job Portal · code-projects
1.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-15677
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-15677
code-projects.org
https://code-projects.org/
github.com
https://github.com/shihuizhang-dazhi/MY-CVE/issues/6
vuldb.com
https://vuldb.com/cve/CVE-2026-15677
vuldb.com
https://vuldb.com/submit/855977
vuldb.com
https://vuldb.com/vuln/378167
vuldb.com
https://vuldb.com/vuln/378167/cti
More from Online Job Portal
9.8
CVE-2023-41014
code-projects.org Online Job Portal 1.0 is vulnerable to SQL Injection via the Username parameter for "Employer."
7.3
CVE-2026-15676
code-projects Online Job Portal DeleteUser.php sql injection
7.3
CVE-2026-15675
code-projects Online Job Portal EditUser.php sql injection
7.3
CVE-2026-14660
code-projects Online Job Portal login.php sql injection
5.5
CVE-2023-41015
code-projects.org Online Job Portal 1.0 is vulnerable to SQL Injection via /Employer/DeleteJob.php?JobId=1