EUVD-2026-29115
GHSA-xxjw-qxjg-jpcw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
HireFlow v1.2 is vulnerable to SQL injection in the /login and /search endpoints. User-supplied input is concatenated directly into SQL queries without parameterization. An unauthenticated attacker can bypass authentication by supplying a crafted username (e.g. admin'--) or extract the full contents of the database including user credentials via UNION-based injection at the /search endpoint.
AnalysisAI
SQL injection in HireFlow v1.2 enables unauthenticated attackers to bypass authentication and exfiltrate the entire database via /login and /search endpoints. Direct string concatenation without parameterization allows both authentication bypass using comment injection (admin'--) and UNION-based data extraction. Public proof-of-concept exists (SSVC: POC, automatable, total technical impact), though EPSS exploitation probability remains low (0.10%, 28th percentile), suggesting limited observed exploitation attempts. CISA SSVC framework classifies this as automatable with total technical impact, warranting immediate patching despite relatively low EPSS score.
Technical ContextAI
This vulnerability affects HireFlow v1.2, a Python-based interview management system. The root cause is CWE-89 (SQL Injection) resulting from unsafe string concatenation in database queries at the /login and /search endpoints. Instead of using parameterized queries or prepared statements, user input is directly interpolated into SQL statements. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable remotely without authentication, user interaction, or complex preconditions. CPE data is incomplete (cpe:2.3:a:n/a:n/a), indicating limited vendor coordination or structured product identification in vulnerability databases. The application appears to be distributed through GitHub (StratonWebDesigners/HireFlow) and sourcecodester.com as open-source code.
RemediationAI
No vendor-released patch or fixed version identified at time of analysis - the GitHub repository (github.com/StratonWebDesigners/HireFlow) and sourcecodester distribution lack published security advisories or version updates addressing CVE-2026-38567. Organizations must implement compensating controls immediately: (1) Replace all SQL queries in /login and /search endpoints with parameterized queries or ORM-based database access to prevent injection - requires code modification and testing; (2) Deploy web application firewall (WAF) with SQL injection signatures targeting the vulnerable endpoints as temporary mitigation - may cause false positives blocking legitimate searches containing SQL-like syntax; (3) Restrict network access to HireFlow to trusted IP ranges only via firewall rules - eliminates remote unauthenticated attack vector but breaks functionality for remote users; (4) Implement database-level least privilege by creating application service account with read-only access where possible and no access to credential tables - limits data exfiltration scope but may break legitimate application functionality. The POC repository (github.com/hijackedamygdala/CVE-Disclosures/tree/main/HireFlow/CVE-2026-38567) may contain technical details useful for validating mitigations. Long-term solution requires migrating to actively maintained alternatives or forking HireFlow to implement secure coding practices.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today