CVE-2026-116049
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A SQL Injection vulnerability was found in EmployeeRecruitmentSystem (krupalshah) in /source/registerform2.php within the mysql_query function. Manipulating the university/institute/branch/degree/status/cpi/semester/experience arguments enables remote attack, and the exploit has been publicly disclosed. The product is no longer supported, and the vendor did not respond to the disclosure.
Risk Assessment
Potential compromise or modification of recruitment database data and further exploitation by remote attackers. Lack of vendor support rules out a quick official fix.
Recommendation
Cut off public access to the application, enforce query parameterization and input validation, and plan migration to a supported system.
Other vulnerabilities in EmployeeRecruitmentSystem
See all- CVE-2026-116048High
A SQL injection vulnerability was detected in krupalshah EmployeeRecruitmentSystem within the mysql_query function of /source/registerform1.php. Manipulation of the firstname, middlename, lastname, gender, birthdate, state, statespecify, city, and cityspecify arguments allows SQL injection. The exploit is publicly available and can be launched remotely.
- CVE-2026-108807High
A SQL Injection vulnerability in krupalshah EmployeeRecruitmentSystem (up to a specific commit) affects the mysql_query function in source/adminregister.php of the Registration Handler component, allowing remote SQL injection.
- CVE-2026-108806High
A SQL Injection vulnerability in krupalshah EmployeeRecruitmentSystem (up to a specific commit) affects the mysql_query function in source/authprocessing.php of the Forgot Password Handler component, where manipulation of the fpemail argument leads to SQL injection.
- CVE-2026-108805High
A SQL Injection vulnerability in krupalshah EmployeeRecruitmentSystem (up to a specific commit) affects the mysql_query function in source/loginprocessing.php of the Login Handler component, where manipulation of email/password arguments leads to SQL injection.
Original NVD description (English source)
A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the function mysql_query of the file /source/registerform2.php of the component Registration Wizard. Executing a manipulation of the argument university/institute/branch/degree/status/cpi/semester/experience can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS