CVE-2026-14660: SQL Injection in code-projects Online Job Portal 1.0 Login - Critical Remote Vulnerability

Technical summary

CVE-2026-14660 is a SQL injection flaw (CWE-89) combined with improper neutralization of special elements used in an SQL command (CWE-74). The vulnerability resides in login.php where user-supplied input from txtUser and txtPass parameters is not properly sanitized before being incorporated into SQL queries. The attack vector is network-based, requires no authentication or user interaction, and operates in the system's security context without privilege escalation. The CVSS 3.1 score of 7.3 reflects confidentiality, integrity, and availability impacts with low attack complexity.

Business impact

A successful exploit could allow attackers to gain unauthorized access to user accounts without valid credentials, access sensitive personal and job-related information stored in the portal's database, modify or delete job listings and user records, and potentially establish persistence for further attacks. Organizations relying on this portal for job management face reputational damage, regulatory compliance violations (GDPR, CCPA if personal data is exposed), and operational disruption. The public availability of exploit details significantly accelerates the timeline to widespread attacks.

Affected systems

code-projects Online Job Portal version 1.0 is confirmed affected. Organizations running this specific version should assume active risk. Later versions, if available from the vendor, may address this issue but require verification against official vendor advisories.

Exploitability

Exploitability is high due to multiple factors: the vulnerability requires no authentication or user interaction to trigger, the attack is remotely accessible over the network, exploit code or techniques have been publicly disclosed, and SQL injection is a well-understood attack pattern with readily available tools. An attacker needs only network access to the login.php endpoint—no special privileges, no social engineering, no local access required. The combination of low attack complexity and public exploit availability means active exploitation is likely occurring or imminent.

Remediation

The immediate priority is to upgrade to a patched version from the vendor—verify the version number and security fixes against the official code-projects advisory. If an upgrade is unavailable, implement input validation and parameterized queries (prepared statements) in login.php to neutralize SQL injection. Apply Web Application Firewall rules to detect and block SQL injection patterns targeting the login endpoint. Conduct database access reviews to revoke unnecessary permissions and implement least-privilege database user accounts for the application. Audit login logs and database activity for signs of unauthorized access.

Patch guidance

Contact code-projects for patch availability and version information. Apply patches immediately upon release given the high severity and public exploit status. Test patches in a staging environment before production deployment to ensure compatibility with your deployment. If patching is delayed, compensating controls such as WAF rules and input validation must be prioritized. Document the patch application date and confirm successful deployment across all instances of the portal.

Detection guidance

Monitor login.php for HTTP requests containing SQL metacharacters (quotes, semicolons, comment symbols, UNION keywords) in txtUser and txtPass parameters. Enable database query logging to identify anomalous SQL statements such as UNION-based queries, time-based delays (WAITFOR, SLEEP), or multi-statement execution. Set alerts for failed login attempts followed by successful access without valid credentials. Review web server access logs for patterns typical of SQL injection probing. Implement endpoint detection and response (EDR) solutions to flag suspicious database activity on systems hosting the portal.

Why prioritize this

This vulnerability merits high-priority patching due to the combination of high CVSS score (7.3), unauthenticated remote exploitability, public exploit availability, direct impact on authentication security, and broad business consequences. The lack of KEV designation does not diminish urgency—public exploit availability is a critical signal. Organizations should treat this as a critical remediation candidate.

Risk score, explained

The CVSS 3.1 score of 7.3 (HIGH) reflects: Network attack vector (AV:N), low attack complexity (AC:L), no privilege requirements (PR:N), no user interaction (UI:N), direct system scope (S:U), and partial impact to confidentiality, integrity, and availability (C:L/I:L/A:L). The score is elevated by the remote, unauthenticated nature and broad exploitation potential, but is not critical because impacts are classified as partial rather than complete system compromise. The practical risk is higher than the score suggests due to public exploit availability and authentication bypass implications.

Frequently asked questions