EmployeeRecruitmentSystem CVE-2026-108806

Requires a network-reachable deployment of krupalshah EmployeeRecruitmentSystem exposing the Forgot Password feature (source/authprocessing.php); the attacker sends a malicious 'fpemail' value to the forgot-password request. No authentication, no user interaction, and no special non-default configuration are needed (CVSS AV:N/AC:L/PR:N/UI:N), so any publicly exposed instance is exploitable. The primary limiting factors are not technical but environmental: the product is an obscure, unversioned, unmaintained application with minimal real-world deployment, and no patch is or will be available.

This is a high-CVSS-equivalent-sounding but genuinely low-priority issue when all signals are weighed. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated SQL injection, but the vendor-assigned score is only 5.5 (Medium) because all impact metrics are rated Low (VC:L/VI:L/VA:L) - VulDB characteristically scores SQLi conservatively, so the true data-confidentiality impact of a SQL injection could be higher than VC:L implies and should be verified. The CVSS carries E:P (Proof-of-Concept), consistent with the description's statement that an exploit has been publicly disclosed; however, there is NO CISA KEV listing and NO EPSS score was provided in the input, so there is no evidence of real-world exploitation volume. No SSVC decision data was supplied. The dominant risk-limiting factor is the target itself: an obscure, unversioned, unmaintained GitHub hobby project (krupalshah EmployeeRecruitmentSystem) whose vendor did not respond to disclosure. Low deployment footprint means that despite easy exploitability, aggregate real-world risk is low and likely limited to opportunistic scanning of exposed instances rather than widespread campaigns.

A remote, unauthenticated attacker submits a crafted value in the 'fpemail' parameter of the Forgot Password handler (source/authprocessing.php), injecting SQL into the mysql_query call to read or manipulate backend database records such as user credentials. A public proof-of-concept exploit has been disclosed, lowering the skill barrier; given the network attack vector and low complexity, exploitation requires no authentication or user interaction.