Employee Recruitment System EUVD-2026-109378

Exploitation requires that the application's registration component (/source/registerform3.php) be network-reachable and that the 'pemail' parameter be processed as part of a database query; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, elevated privileges, or user interaction is needed against a reachable instance. The practical limiting factors are deployment scope and lifecycle: the product is no longer supported and is distributed via rolling releases with no version identifiers, so there is no fixed release to apply, and the only mitigations are those a defender can impose independently (restricting access to or retiring the application). The trigger beyond manipulation of the 'pemail' argument is not further described in the available sources.

The signals point to a genuine but moderate-priority issue rather than an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw requiring no user interaction, which maximizes reachability; however, the impact metrics are all Low (VC:L/VI:L/VA:L) and scope is unchanged, yielding a score of 6.9 (Medium). The embedded E:P (Proof-of-Concept) exploit maturity aligns with the input's note that only an unverified PoC reference exists - not confirmed working exploit code - so reachability is high but demonstrated weaponization is not established. There is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation; the vuln.today decision label is 'this_month', consistent with a real-but-not-urgent remediation cadence. The most important risk-limiting factor is not technical but lifecycle: the vendor confirms this product is no longer supported and uses rolling releases, so no fixed version exists and the vendor did not respond - meaning any deployment is unpatchable and must be mitigated or retired. Low EPSS/KEV absence combined with a PoC-stage exploit and an abandoned, obscure product suggests opportunistic rather than mass exploitation risk.

A remote, unauthenticated attacker submits a crafted value in the 'pemail' parameter to /source/registerform3.php, injecting SQL into the registration query (CWE-89). This could let them read or tamper with limited database contents such as applicant or account records. A public PoC reference exists but is not verified as working exploit code, so practical exploitation may require an attacker to reconstruct the payload.