CVE-2026-6201

MediumCVSS 5.4/10Last modified Oct 26, 2026

Description

A vulnerability was identified in CodeAstro Online Job Portal 1.0. The impacted element is an unknown function of the file /jobs/job-delete.php of the component Delete Job Posting Handler. Such manipulation of the argument ID leads to improper access controls. The attack can be launched remotely. The exploit is publicly available and might be used.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-266CWE-284

Affected software

VendorProductVersions
CodeAstroOnline Job Portal1.0

References

Timeline

Published
Apr 13, 2026
Last modified
Oct 26, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-620109.8Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.CVE-2026-620119.8Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.CVE-2026-620129.8Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.CVE-2026-620139.8Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.CVE-2026-620149.8Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.CVE-2026-620159.8Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.CVE-2026-620169.8Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.CVE-2026-620179.8Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.CVE-2026-620189.8Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.CVE-2026-620194.3Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Access Control SecurityCVE-2026-62026.3A security flaw has been discovered in code-projects Easy Blog Site 1.0. This affects an unknown function of the file post.php. Performing aCVE-2026-620208.1Unauthenticated Local File Inclusion in TouchUp < 1.4 versions.
CVE-2026-6201: Medium severity, CVSS 5.4 | Vulnix