Medium severity · published Apr 26, 2026
CVE-2026-7028
CodeAstro Online Job Portal All Jobs delete-jobs.php sql injection
4.7
CVSS
0.3%
EPSS
No
On KEV
Description
A security flaw has been discovered in CodeAstro Online Job Portal 1.0. The affected element is an unknown function of the file /admin/jobs-admins/delete-jobs.php of the component All Jobs Page. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OJ
Online Job Portal · CodeAstro
1.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-7028
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-7028
codeastro.com
https://codeastro.com/
github.com
https://github.com/Xmyronn/CodeAstro-Online-Job-Portal-SQLi-Delete-All.git
vuldb.com
https://vuldb.com/submit/797969
vuldb.com
https://vuldb.com/vuln/359608
vuldb.com
https://vuldb.com/vuln/359608/cti
More from Online Job Portal
7.3
CVE-2026-10261
CodeAstro Online Job Portal application_status.php sql injection
7.3
CVE-2026-10260
CodeAstro Online Job Portal delete-jobs.php sql injection
6.3
CVE-2026-77681
CodeAstro Online Job Portal update-profile.php unrestricted upload
5.4
CVE-2026-6201
CodeAstro Online Job Portal Delete Job Posting job-delete.php access control
5.3
CVE-2026-7071
CodeAstro Online Job Portal user-cvs file information disclosure