Medium severity · published Apr 13, 2026
CVE-2026-6201
CodeAstro Online Job Portal Delete Job Posting job-delete.php access control
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability was identified in CodeAstro Online Job Portal 1.0. The impacted element is an unknown function of the file /jobs/job-delete.php of the component Delete Job Posting Handler. Such manipulation of the argument ID leads to improper access controls. The attack can be launched remotely. The exploit is publicly available and might be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OJ
Online Job Portal · CodeAstro
1.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-6201
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-6201
codeastro.com
https://codeastro.com/
github.com
https://github.com/Xmyronn/CodeAstro-Online-Job-Portal-IDOR.git
vuldb.com
https://vuldb.com/submit/797515
vuldb.com
https://vuldb.com/vuln/357123
vuldb.com
https://vuldb.com/vuln/357123/cti
More from Online Job Portal
7.3
CVE-2026-10261
CodeAstro Online Job Portal application_status.php sql injection
7.3
CVE-2026-10260
CodeAstro Online Job Portal delete-jobs.php sql injection
6.3
CVE-2026-77681
CodeAstro Online Job Portal update-profile.php unrestricted upload
5.3
CVE-2026-7071
CodeAstro Online Job Portal user-cvs file information disclosure
4.7
CVE-2026-7028
CodeAstro Online Job Portal All Jobs delete-jobs.php sql injection