The vulnerability CVE-2026-14660 affects code-projects Online Job Portal 1.0. It is a SQL injection flaw in an unknown function of login.php, triggered by manipulating the txtUser or txtPass arguments. The vulnerability allows an unauthenticated remote attacker to inject SQL commands, potentially compromising the backend database. The exploit details have been made public, but no known exploits in the wild have been reported. No vendor advisory or patch information is currently available.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL queries on the backend database. This may lead to unauthorized data access, data modification, or other database-related impacts depending on the database privileges. The vulnerability is remotely exploitable without authentication, increasing the risk of attack. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting login.php parameters txtUser and txtPass. Avoid exposing the vulnerable service to untrusted networks if possible.