EmployeeRecruitmentSystem EUVD-2026-97240

No special configuration required - the vulnerable code path is the application's primary login handler (source/loginprocessing.php), so any deployment that exposes the login form over the network is exploitable by a remote unauthenticated attacker (AV:N/PR:N/UI:N) supplying a malicious email or password value. The practical limiting factors are not technical prerequisites but deployment reality: the product is an unmaintained, rolling-release open-source project with no supported/patched version, so exposure depends on whether anyone runs the affected commit (up to 922ff6d) and whether that instance is network-reachable.

Signals are consistent and point to a genuine but modest risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated SQL injection, which is easy to trigger; however, impact is rated Low across confidentiality, integrity and availability (VC:L/VI:L/VA:L) and scope is unchanged, yielding a Medium base score of 6.9. The Exploit Maturity metric E:P (Proof-of-Concept) aligns with the confirmed public exploit on GitHub, so publicly available exploit code exists - but this is NOT confirmed active exploitation: the CVE is not listed in CISA KEV and no EPSS score was provided in the input. The dominant risk-limiting factor is the target itself: an obscure, unmaintained open-source PHP project (EmployeeRecruitmentSystem) with no enterprise footprint, so mass exploitation is unlikely despite the low attack complexity. Note the Low impact ratings are somewhat conservative for a login-handler SQLi, which can often enable authentication bypass or full database read - verify actual impact against the exploit before deprioritizing. Bottom line: a real, trivially exploitable flaw but a low-priority issue for most defenders due to negligible deployment and no evidence of in-the-wild use.

A remote, unauthenticated attacker submits a crafted email or password value to source/loginprocessing.php, breaking out of the SQL statement passed to mysql_query to inject attacker-controlled SQL. A proof-of-concept exploit is publicly published on GitHub, lowering the skill barrier; because the login form is the entry point (AC:L, PR:N, UI:N), exploitation requires only HTTP access to the application.