What is the CVSS score of CVE-2026-38567?

CVE-2026-38567 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of HireFlow are affected by CVE-2026-38567?

HireFlow v1.2 contains a critical unauthenticated SQL injection vulnerability affecting login and search endpoints that allows attackers to bypass authentication and exfiltrate the entire employee…

How to fix or mitigate CVE-2026-38567?

Within 24 hours: Isolate HireFlow instances from production networks or implement network-level access controls limiting /login and /search endpoints to authorized IPs only. Within 7 days: Contact HireFlow vendor for emergency security update or request detailed timeline for patch availability; evaluate alternative HRIS solutions if patch unavailable. Within 30 days: Apply vendor-released patch immediately upon availability and conduct forensic audit of database access logs for unauthorized queries since deployment.

HireFlow CVE-2026-38567

EUVD-2026-29115 CRITICAL

SQL Injection (CWE-89)

2026-05-11 mitre

GHSA-xxjw-qxjg-jpcw

SQLi N A

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 16:30 vuln.today

CVSS changed

May 12, 2026 - 14:22 NVD

9.8 (CRITICAL)

CVE Published

May 11, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

CVE Published

May 11, 2026 - 00:00 nvd

CRITICAL 9.8

DescriptionCVE.org

HireFlow v1.2 is vulnerable to SQL injection in the /login and /search endpoints. User-supplied input is concatenated directly into SQL queries without parameterization. An unauthenticated attacker can bypass authentication by supplying a crafted username (e.g. admin'--) or extract the full contents of the database including user credentials via UNION-based injection at the /search endpoint.

AnalysisAI

SQL injection in HireFlow v1.2 enables unauthenticated attackers to bypass authentication and exfiltrate the entire database via /login and /search endpoints. Direct string concatenation without parameterization allows both authentication bypass using comment injection (admin'--) and UNION-based data extraction. Public proof-of-concept exists (SSVC: POC, automatable, total technical impact), though EPSS exploitation probability remains low (0.10%, 28th percentile), suggesting limited observed exploitation attempts. CISA SSVC framework classifies this as automatable with total technical impact, warranting immediate patching despite relatively low EPSS score.

Technical ContextAI

This vulnerability affects HireFlow v1.2, a Python-based interview management system. The root cause is CWE-89 (SQL Injection) resulting from unsafe string concatenation in database queries at the /login and /search endpoints. Instead of using parameterized queries or prepared statements, user input is directly interpolated into SQL statements. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable remotely without authentication, user interaction, or complex preconditions. CPE data is incomplete (cpe:2.3:a:n/a:n/a), indicating limited vendor coordination or structured product identification in vulnerability databases. The application appears to be distributed through GitHub (StratonWebDesigners/HireFlow) and sourcecodester.com as open-source code.

RemediationAI

No vendor-released patch or fixed version identified at time of analysis - the GitHub repository (github.com/StratonWebDesigners/HireFlow) and sourcecodester distribution lack published security advisories or version updates addressing CVE-2026-38567. Organizations must implement compensating controls immediately: (1) Replace all SQL queries in /login and /search endpoints with parameterized queries or ORM-based database access to prevent injection - requires code modification and testing; (2) Deploy web application firewall (WAF) with SQL injection signatures targeting the vulnerable endpoints as temporary mitigation - may cause false positives blocking legitimate searches containing SQL-like syntax; (3) Restrict network access to HireFlow to trusted IP ranges only via firewall rules - eliminates remote unauthenticated attack vector but breaks functionality for remote users; (4) Implement database-level least privilege by creating application service account with read-only access where possible and no access to credential tables - limits data exfiltration scope but may break legitimate application functionality. The POC repository (github.com/hijackedamygdala/CVE-Disclosures/tree/main/HireFlow/CVE-2026-38567) may contain technical details useful for validating mitigations. Long-term solution requires migrating to actively maintained alternatives or forking HireFlow to implement secure coding practices.