CVE-2026-116048
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A SQL injection vulnerability was detected in krupalshah EmployeeRecruitmentSystem within the mysql_query function of /source/registerform1.php. Manipulation of the firstname, middlename, lastname, gender, birthdate, state, statespecify, city, and cityspecify arguments allows SQL injection. The exploit is publicly available and can be launched remotely.
Risk Assessment
This vulnerability enables remote SQL injection, potentially leading to unauthorized database access, modification, or leakage of candidate personal data. Since the product is no longer supported by the maintainer, the risk remains high with no official patch available.
Recommendation
Immediately discontinue use of this component or implement custom fixes (e.g., parameterized queries) and restrict access to registerform1.php. If possible, replace the software with a supported solution.
Other vulnerabilities in EmployeeRecruitmentSystem
See all- CVE-2026-116049High
A SQL Injection vulnerability was found in EmployeeRecruitmentSystem (krupalshah) in /source/registerform2.php within the mysql_query function. Manipulating the university/institute/branch/degree/status/cpi/semester/experience arguments enables remote attack, and the exploit has been publicly disclosed. The product is no longer supported, and the vendor did not respond to the disclosure.
- CVE-2026-108807High
A SQL Injection vulnerability in krupalshah EmployeeRecruitmentSystem (up to a specific commit) affects the mysql_query function in source/adminregister.php of the Registration Handler component, allowing remote SQL injection.
- CVE-2026-108806High
A SQL Injection vulnerability in krupalshah EmployeeRecruitmentSystem (up to a specific commit) affects the mysql_query function in source/authprocessing.php of the Forgot Password Handler component, where manipulation of the fpemail argument leads to SQL injection.
- CVE-2026-108805High
A SQL Injection vulnerability in krupalshah EmployeeRecruitmentSystem (up to a specific commit) affects the mysql_query function in source/loginprocessing.php of the Login Handler component, where manipulation of email/password arguments leads to SQL injection.
Original NVD description (English source)
A vulnerability was detected in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this vulnerability is the function mysql_query of the file /source/registerform1.php of the component Registration. Performing a manipulation of the argument firstname/middlename/lastname/gender/birthdate/state/statespecify/city/cityspecify results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS