Executive brief
A security vulnerability exists in the Online Job Portal System, a web application used for managing job listings and recruitment. An attacker can inject malicious scripts into the portal, which could then execute in the browsers of other users, such as administrators or job seekers. This could lead to unauthorized actions being performed in the context of the victim's session or the defacement of portal content.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in code-projects Online Job Portal 1.0 due to improper neutralization of input during web page generation (CWE-79). The root cause is the failure to use output encoding or escaping (such as htmlspecialchars) when displaying database-stored content in /Admin/DetailJob.php, /News.php, and /Admin/EditUser.php. A remote attacker with low privileges can inject malicious scripts into the database, which are subsequently executed in the browser of any user viewing the affected pages. The exploit has been publicly disclosed in a GitHub issue.
Affected products
- code-projects Online Job Portal System 1.0
Timeline
- 2026-06-11: disclosed: Vulnerability details shared on GitHub issue
- 2026-07-14: advisory: NVD publication date