EmployeeRecruitmentSystem EUVD-2026-109375

Exploitation requires that the Registration Wizard page /source/registerform2.php be network-reachable and accepting registration submissions; the attacker manipulates one of the specific fields university, institute, branch, degree, status, cpi, semester, or experience, which flow into a mysql_query call. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is required, so against a default deployment with the registration form exposed this is remotely triggerable by an unauthenticated attacker. The principal limiting factors are the product's rarity and unsupported status (no patch exists), the possibility that a deployment restricts or disables public registration, and that the published PoC is a reference only and not verified as working exploit code.

This is a CWE-89 SQL injection reachable over the network against the Registration Wizard (/source/registerform2.php) of krupalshah EmployeeRecruitmentSystem. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation with no user interaction, which is consistent with a registration form that must be publicly reachable. However, impact is rated only partial across all three dimensions (VC:L/VI:L/VA:L), yielding a medium score of 6.9 rather than the critical rating that full database compromise would carry - the scoring authority (VulDB) evidently judged the injection to yield limited rather than total confidentiality/integrity/availability impact, which is a notable constraint for a SQLi finding and should be verified. On the real-risk signals: there is NO CISA KEV listing and NO confirmed working exploit; the input provides only a PoC reference (GitHub issue) that is explicitly not verified as working exploit code, and no EPSS probability is supplied. The vuln.today decision label is 'this_month', i.e. a routine prioritization rather than act_now or emergency. Weighing these together, the network/unauthenticated exposure keeps this above background noise, but the partial impact, the obscure/unsupported product, the unverified PoC, and the non-urgent decision label all point to this being a modest-priority issue rather than a widespread emergency.

A remote, unauthenticated attacker submits the public registration form at /source/registerform2.php and injects SQL through one of the vulnerable fields (university, institute, branch, degree, status, cpi, semester, or experience), which is passed into a mysql_query call without sanitization. A public PoC reference exists but is not verified as working exploit code, so an attacker would likely need to adapt or re-develop the payload to extract or manipulate data in the backend MySQL database.