CVE-2026-77681— CodeAstro Online Job Portal update-profile.php unrestricted upload
Quick assessment
Affected
CodeAstro Online Job Portal
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 CodeAstro Online Job Portal 1.0 中发现了一个漏洞。受该漏洞影响的是文件 /users/update-profile.php 的某个未知功能。对参数 Name 进行操作可导致无限制的文件上传。攻击可以远程发起。该漏洞利用程序已公开，可能被攻击者使用。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| CodeAstro | Online Job Portal | 1.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-77681
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
CodeAstro Online Job Portal update-profile.php unrestricted upload
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was identified in CodeAstro Online Job Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /users/update-profile.php. The manipulation of the argument Name leads to unrestricted upload. The attack can be initiated remotely. The exploit is publicly available and might be used.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
危险类型文件的不加限制上传
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| CodeAstro | Online Job Portal | 1.0 |
cpe:2.3:a:codeastro:online_job_portal:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-77681
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-77681
请登录查看更多情报信息。
Exploits & Public PoCs for CVE-2026-77681 (1)
IV. Related Vulnerabilities
Same product: Online Job Portal
-
CVE-2026-15678
code-projects Online Job Portal DetailJob.php cross site scr -
CVE-2026-15677
code-projects Online Job Portal JobSeekerInsert.php unrestri -
CVE-2026-15676
code-projects Online Job Portal DeleteUser.php sql injection -
CVE-2026-15675
code-projects Online Job Portal EditUser.php sql injection -
CVE-2026-14660
code-projects Online Job Portal login.php sql injection
Same vendor: CodeAstro
-
CVE-2026-77020
CodeAstro Apartment Visitor Management System password-recov -
CVE-2026-77019
CodeAstro Apartment Visitor Management System forgotpw.php s -
CVE-2026-16765
CodeAstro Online Classroom loginlinkadmin.php sql injection -
CVE-2026-15559
CodeAstro Simple Online Leave Management System POST accept. -
CVE-2026-15558
CodeAstro Simple Online Leave Management System deletemp.php
Same weakness: CWE-434
-
CVE-2026-49849
xShop: Unrestricted File Upload in File Attachment Module in -
CVE-2026-2334
) Missing Server-Side File Extension Validation in vsDesk -
CVE-2026-76995
SourceCodester Simple Online Food Ordering System ajax.php s -
CVE-2026-64960
Remote Code Execution via Unrestricted File Upload in ATutor -
CVE-2026-74018
WordPress Warehouse Cargo theme <= 2.6.9 - Arbitrary File Up
V. Comments for CVE-2026-77681
No comments yet