CVE-2026-38567
CriticalSummary
HireFlow v1.2 is vulnerable to SQL injection in the /login and /search endpoints. User-supplied input is concatenated directly into SQL queries without parameterization.
Risk Assessment
An unauthenticated attacker can bypass authentication by supplying a crafted username or extract the full contents of the database including user credentials.
Recommendation
It is recommended to implement parameterized SQL queries and review and secure the /login and /search endpoints against potential attacks.
Other vulnerabilities in HireFlow v1.2
See all- CVE-2026-38568High
HireFlow v1.2 is vulnerable to Incorrect Access Control. The application does not enforce object-level authorization on the /candidate/<id> and /interview/<id> endpoints, allowing access to other users' data.
- CVE-2026-38566High
HireFlow v1.2 does not implement CSRF token validation on any state-changing POST endpoint. All forms are vulnerable to CSRF, allowing an attacker to change the victim's password, delete records, or inject arbitrary data.
- CVE-2026-45336Critical
HireFlow versions 1.2 and earlier use a hard-coded Flask secret_key for signing session cookies. Knowing this publicly available value, an unauthenticated attacker can forge cookies with role=admin and arbitrary user_id, bypassing authentication.
Original NVD description (English source)
HireFlow v1.2 is vulnerable to SQL injection in the /login and /search endpoints. User-supplied input is concatenated directly into SQL queries without parameterization. An unauthenticated attacker can bypass authentication by supplying a crafted username (e.g. admin'--) or extract the full contents of the database including user credentials via UNION-based injection at the /search endpoint.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS