Employeerecruitmentsystem
Monthly
Unauthenticated SQL injection in the Registration Wizard of krupalshah EmployeeRecruitmentSystem (PHP file /source/registerform2.php) lets remote attackers manipulate the university, institute, branch, degree, status, cpi, semester or experience arguments that flow into a mysql_query call, allowing them to read or alter backend data. The project is a rolling-release PHP application that the maintainer no longer supports and did not respond to the disclosure, so no fixed release is identified; the affected code is confirmed only up to commit 922ff6d208278282e7c8e36d70d9ae356adec9fe, and the CPE wildcard leaves the full affected version range undefined. A public PoC reference exists but is not verified as working exploit code, and there is no confirmed active exploitation (no CISA KEV entry); exploitation is bounded by the product's rarity and by whether a deployment exposes or disables public registration.
SQL injection in the registration endpoint (/source/registerform1.php) of krupalshah EmployeeRecruitmentSystem lets remote, unauthenticated attackers inject arbitrary SQL through the firstname, middlename, lastname, gender, birthdate, state, statespecify, city and cityspecify parameters, with low confidentiality, integrity and availability impact per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). The project ships as a rolling release with no version identifiers, the maintainer was contacted and did not respond, and the codebase is no longer supported, so there is no fixed build to upgrade to. A public PoC reference exists in a GitHub issue tracker; it is not verified as working exploit code, and there is no confirmed active exploitation (no CISA KEV listing) - the practical constraint on this CVE is footprint, not exploitability, and it is triaged for handling this month.
Unauthenticated SQL injection in the krupalshah EmployeeRecruitmentSystem admin registration handler (source/adminregister.php) allows remote attackers to manipulate backend database queries through crafted input to the registration form. Per the assessed vector (AV:N/AC:L/PR:N/UI:N), no credentials or user interaction are required, so any internet-exposed instance running the project is directly attackable, though impact is bounded to low confidentiality, integrity, and availability loss (CVSS 3.1 base 5.5-style, CVSS 4.0 score 5.5 with E:P). Publicly available exploit code exists (referenced from a GitHub CVE issue and VulDB submission 963381), but this CVE is not confirmed as actively exploited (no CISA KEV listing); EPSS data was not provided. The practical risk is driven less by exploitation difficulty than by exposure: the project is an abandoned, unsupported, rolling-release GitHub repository with no tagged versions.
SQL injection in krupalshah EmployeeRecruitmentSystem (commit 922ff6d and earlier) allows remote unauthenticated attackers to inject arbitrary SQL through the email or password parameter of the login handler at source/loginprocessing.php. The flaw arises from direct use of mysql_query() without parameterization, enabling read or modification of backend database contents. Publicly available exploit code exists, and because the project is an unmaintained rolling release, no vendor patch or supported version is available.
Unauthenticated SQL injection in the Registration Wizard of krupalshah EmployeeRecruitmentSystem (PHP file /source/registerform2.php) lets remote attackers manipulate the university, institute, branch, degree, status, cpi, semester or experience arguments that flow into a mysql_query call, allowing them to read or alter backend data. The project is a rolling-release PHP application that the maintainer no longer supports and did not respond to the disclosure, so no fixed release is identified; the affected code is confirmed only up to commit 922ff6d208278282e7c8e36d70d9ae356adec9fe, and the CPE wildcard leaves the full affected version range undefined. A public PoC reference exists but is not verified as working exploit code, and there is no confirmed active exploitation (no CISA KEV entry); exploitation is bounded by the product's rarity and by whether a deployment exposes or disables public registration.
SQL injection in the registration endpoint (/source/registerform1.php) of krupalshah EmployeeRecruitmentSystem lets remote, unauthenticated attackers inject arbitrary SQL through the firstname, middlename, lastname, gender, birthdate, state, statespecify, city and cityspecify parameters, with low confidentiality, integrity and availability impact per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). The project ships as a rolling release with no version identifiers, the maintainer was contacted and did not respond, and the codebase is no longer supported, so there is no fixed build to upgrade to. A public PoC reference exists in a GitHub issue tracker; it is not verified as working exploit code, and there is no confirmed active exploitation (no CISA KEV listing) - the practical constraint on this CVE is footprint, not exploitability, and it is triaged for handling this month.
Unauthenticated SQL injection in the krupalshah EmployeeRecruitmentSystem admin registration handler (source/adminregister.php) allows remote attackers to manipulate backend database queries through crafted input to the registration form. Per the assessed vector (AV:N/AC:L/PR:N/UI:N), no credentials or user interaction are required, so any internet-exposed instance running the project is directly attackable, though impact is bounded to low confidentiality, integrity, and availability loss (CVSS 3.1 base 5.5-style, CVSS 4.0 score 5.5 with E:P). Publicly available exploit code exists (referenced from a GitHub CVE issue and VulDB submission 963381), but this CVE is not confirmed as actively exploited (no CISA KEV listing); EPSS data was not provided. The practical risk is driven less by exploitation difficulty than by exposure: the project is an abandoned, unsupported, rolling-release GitHub repository with no tagged versions.
SQL injection in krupalshah EmployeeRecruitmentSystem (commit 922ff6d and earlier) allows remote unauthenticated attackers to inject arbitrary SQL through the email or password parameter of the login handler at source/loginprocessing.php. The flaw arises from direct use of mysql_query() without parameterization, enabling read or modification of backend database contents. Publicly available exploit code exists, and because the project is an unmaintained rolling release, no vendor patch or supported version is available.