Is CVE-2026-15676 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15676 being exploited in the wild.

How severe is CVE-2026-15676?

High severity, with a CVSS score of 7.3, published 14 July 2026.

Which products and versions are affected?

Code-Projects Online Job Portal 1.0.

Is there a fix for CVE-2026-15676?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15676 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-15676?

Check whether you run Code-Projects Online Job Portal at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15676: code-projects Online Job Portal SQL injection in DeleteUser.php

CVE-2026-15676 · Severity: high · CVSS 7.3 · Published 2026-07-14

A security vulnerability exists in the Online Job Portal, a web application used for managing job listings and user accounts. An attacker can exploit this flaw to delete user accounts, modify data, or access sensitive information without needing a password. This could lead to unauthorized administrative control, loss of user data, and disruption of the job portal's operations.

Technologies: Code-Projects Online Job Portal. Vendors: Code-Projects.

Quick answers

Is CVE-2026-15676 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15676 being exploited in the wild.
How severe is CVE-2026-15676?: High severity, with a CVSS score of 7.3, published 14 July 2026.
Which products and versions are affected?: Code-Projects Online Job Portal 1.0.
Is there a fix for CVE-2026-15676?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15676 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-15676?: Check whether you run Code-Projects Online Job Portal at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Online Job Portal 1.0 contains multiple SQL injection vulnerabilities due to the improper neutralization of special elements in SQL commands. Specifically, files such as /Admin/DeleteUser.php, /Admin/EditUser.php, and /Admin/ApprovEmp.php accept GET parameters (e.g., 'UserId') and concatenate them directly into SQL queries without sanitization. Furthermore, these administrative endpoints lack session validation or authorization checks. A remote, unauthenticated attacker can exploit these flaws by sending crafted HTTP GET requests to perform unauthorized database operations, including deleting users or extracting data. Public exploit details have been released.

Affected products

code-projects Online Job Portal 1.0

Timeline

2026-06-11: disclosed: Initial discovery and issue report on GitHub
2026-07-14: advisory: CVE published and indexed by VulDB/NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.