CVE-2026-10260: CodeAstro Online Job Portal delete-jobs.php sql injection
A vulnerability was detected in CodeAstro Online Job Portal 1.0. The impacted element is an unknown function of the file /admin/jobs-admins/delete-jobs.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
CodeAstro Online Job Portal (/admin/jobs-admins/delete-jobs.php)from your environment.If a secure fix cannot be deployed immediately, remove or disable /admin/jobs-admins/delete-jobs.php (or remove its write/delete functionality) from the webroot or application until the vulnerability is remediated.
- Configuration
Validate and sanitize the ID parameter and rewrite the code to use parameterized queries (prepared statements) or an ORM to eliminate SQL injection in /admin/jobs-admins/delete-jobs.php.
CodeAstro Online Job Portal (/admin/jobs-admins/delete-jobs.php) ID parameter handling / SQL query construction = validate and sanitize input; use parameterized queries / prepared statements - Compensating control
Restrict access to /admin/jobs-admins/delete-jobs.php to trusted administrative IP addresses or require VPN access; deploy WAF rules to block SQL-injection payloads targeting the ID parameter until the code is fixed.
- Operational
Audit web and application logs for signs of exploitation targeting delete-jobs.php and the ID parameter; if exploitation is detected, follow incident response procedures (containment, forensics) and rotate any credentials or secrets that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10260?
CVE-2026-10260 has a medium severity rating of 5.5.
How do I fix CVE-2026-10260?
To fix CVE-2026-10260, validate and sanitize all user inputs to prevent SQL injection.
What type of vulnerability is CVE-2026-10260?
CVE-2026-10260 is classified as an SQL Injection vulnerability.
Who is affected by CVE-2026-10260?
CVE-2026-10260 affects users of CodeAstro Online Job Portal version 1.0.
Can CVE-2026-10260 be exploited remotely?
Yes, CVE-2026-10260 can be exploited remotely by manipulating the argument ID.