Employee Recruitment System
Monthly
SQL injection in the Registration component of krupalshah Employee Recruitment System (/source/registerform3.php) allows unauthenticated remote attackers to manipulate the pemail argument and influence database queries, with low confidentiality, integrity, and availability impact per the assessed CVSS:3.1 vector. The product is unsupported and distributed through rolling releases without version identifiers, so the CPE wildcard covers all deployments up to commit 922ff6d208278282e7c8e36d70d9ae356adec9fe. A public PoC reference exists; it is not verified as working exploit code, and no CISA KEV confirmation of active exploitation is available; the issue is moderate-priority rather than an emergency.
SQL injection in the Registration component of krupalshah Employee Recruitment System (/source/registerform3.php) allows unauthenticated remote attackers to manipulate the pemail argument and influence database queries, with low confidentiality, integrity, and availability impact per the assessed CVSS:3.1 vector. The product is unsupported and distributed through rolling releases without version identifiers, so the CPE wildcard covers all deployments up to commit 922ff6d208278282e7c8e36d70d9ae356adec9fe. A public PoC reference exists; it is not verified as working exploit code, and no CISA KEV confirmation of active exploitation is available; the issue is moderate-priority rather than an emergency.