EUVD-2026-29115
GHSA-xxjw-qxjg-jpcw
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionNVD
HireFlow v1.2 is vulnerable to SQL injection in the /login and /search endpoints. User-supplied input is concatenated directly into SQL queries without parameterization. An unauthenticated attacker can bypass authentication by supplying a crafted username (e.g. admin'--) or extract the full contents of the database including user credentials via UNION-based injection at the /search endpoint.
AnalysisAI
SQL injection in HireFlow v1.2 enables unauthenticated attackers to bypass authentication and exfiltrate the entire database via /login and /search endpoints. Direct string concatenation without parameterization allows both authentication bypass using comment injection (admin'--) and UNION-based data extraction. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Isolate HireFlow instances from production networks or implement network-level access controls limiting /login and /search endpoints to authorized IPs only. Within 7 days: Contact HireFlow vendor for emergency security update or request detailed timeline for patch availability; evaluate alternative HRIS solutions if patch unavailable. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today