Interview Management System CVE-2026-15137

No special conditions are required - the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote unauthenticated exploitation with no attack prerequisites against any network-accessible deployment of Interview Management System 1.0. The sole technical requirement is that /inc/classes/View.php is reachable over HTTP or HTTPS, which is the default state of any deployed instance of this application. No authentication, privilege level, user interaction, or non-default configuration is needed. Exploitation is limited in practice by the product's very narrow real-world deployment footprint (niche PHP application) and the partial Low-level CIA impact ratings, which indicate database-level access rather than full OS compromise.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) places this at maximum accessibility: no authentication, no complexity, no special attack conditions, reachable over the network. The E:P supplemental modifier confirms public exploit availability. Impact is rated Low across all three CIA pillars (VC:L/VI:L/VA:L), consistent with a SQL injection that enables data enumeration and manipulation but does not inherently yield OS-level code execution or full system takeover. No EPSS score was provided in the input data; no KEV listing exists, so confirmed in-the-wild exploitation is absent. Real-world risk is meaningfully constrained by the product's narrow deployment footprint - this is a niche academic/demo PHP application with minimal enterprise presence. However, the complete absence of technical exploitation barriers (no auth, low complexity, public PoC) means any attacker aware of a deployment can trivially exploit it. For organizations running this specific application, this should be treated as a high-priority remediation item despite the moderate CVSS score.

A remote unauthenticated attacker identifies a publicly accessible deployment of Interview Management System 1.0, then sends a crafted HTTP request to /inc/classes/View.php with a SQL-injected ID parameter (e.g., a UNION SELECT payload or boolean-based blind injection string). The application passes the unsanitized value directly into a SQL query, allowing the attacker to enumerate table structures, extract stored credentials or interview candidate PII, and potentially modify or delete application records. A public proof-of-concept demonstrating this technique is available at https://github.com/susususua-AI/CVE/issues/2.