Online Recruitment Management System
Monthly
A vulnerability was identified in Campcodes Online Recruitment Management System 1.0.php?page=view_vacancy. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in Campcodes Online Recruitment Management System 1.0 exposes the admin AJAX endpoint at /admin/ajax.php?action=save_user to unauthenticated remote attackers who can manipulate the id parameter to inject arbitrary SQL. Based on the CVSS 4.0 vector (PR:N/UI:N/AV:N), no authentication or user interaction is required, enabling direct database read, write, and potential availability disruption. A public proof-of-concept exploit is available on GitHub, lowering the skill barrier for exploitation, though EPSS at 0.07% (21st percentile) and absence from CISA KEV indicate no confirmed widespread active exploitation at time of analysis.
SQL injection in Campcodes Online Recruitment Management System 1.0 allows remote attackers to manipulate database queries via the unsanitized `id` parameter in `/admin/ajax.php?action=delete_recruitment_status`. A publicly available proof-of-concept exploit has been disclosed on GitHub. No active exploitation is confirmed by CISA KEV, and EPSS sits at 0.07% (21st percentile), indicating low observed exploitation interest likely reflecting the product's niche deployment footprint rather than difficulty of exploitation.
SQL injection in Campcodes Online Recruitment Management System 1.0 exposes the `/admin/ajax.php?action=save_recruitment_status` endpoint to remote unauthenticated attackers who can manipulate the `ID` parameter to read, modify, or partially disrupt the underlying database. A public proof-of-concept exploit has been disclosed on GitHub, lowering the barrier for opportunistic attacks. No confirmed active exploitation (CISA KEV) has been recorded, and EPSS at 0.09% (25th percentile) reflects minimal observed automated targeting, but the public POC makes internet-facing deployments a realistic target.
CVE-2025-7436 is a critical SQL injection vulnerability in Campcodes Online Recruitment Management System version 1.0, affecting the /admin/ajax.php?action=delete_vacancy endpoint where the ID parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or system compromise. A proof-of-concept exploit has been publicly disclosed, increasing real-world exploitation risk.
SQL injection in Campcodes Online Recruitment Management System 1.0 allows remote attackers to inject malicious SQL via the ID parameter in /admin/view_vacancy.php, potentially leading to low‑impact data leakage or modification. Public exploit code exists, but
SQL injection vulnerability in Campcodes Online Recruitment Management System 1.0 allows unauthenticated remote attackers to manipulate or extract database contents via the ID parameter in /admin/ajax.php?action=save_vacancy. Public exploit code is available, but the CVSS 4.0 score of 5.5 indicates only low impact to confidentiality, integrity, and availability. No active exploitation has been reported in CISA KEV, and EPSS probability is low (0.06%).
SQL injection in Campcodes Online Recruitment Management System 1.0 allows remote attackers to manipulate database records via the ID parameter in /admin/ajax.php?action=delete_application. Public exploit code is available, but no active exploitation has been confirmed by CISA KEV; EPSS indicates a low 0.06% probability of widespread attacks.
CVE-2025-6567 is a critical SQL injection vulnerability in Campcodes Online Recruitment Management System version 1.0, specifically in the Recruitment/admin/view_application.php file where the ID parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of recruitment records. The vulnerability has been publicly disclosed with proof-of-concept code available, and exploitation requires no special privileges or user interaction.
Unrestricted file upload in Campcodes Online Recruitment Management System 1.0 allows authenticated attackers to upload arbitrary PHP files via the /admin/ajax.php?action=save_settings endpoint, leading to remote code execution. A public exploit is available, but no active exploitation has been reported (EPSS 0.12%).
Critical SQL injection vulnerability in Campcodes Online Recruitment Management System version 1.0 affecting the /admin/ajax.php?action=save_application endpoint. An unauthenticated remote attacker can manipulate the position_id parameter to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with proof-of-concept code available, making active exploitation likely.
Critical SQL injection vulnerability in Campcodes Online Recruitment Management System version 1.0, affecting the authentication endpoint at /admin/ajax.php?action=login. An unauthenticated remote attacker can manipulate the Username parameter to execute arbitrary SQL queries, potentially leading to unauthorized access, data exfiltration, or database manipulation. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk.
A vulnerability was identified in Campcodes Online Recruitment Management System 1.0.php?page=view_vacancy. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in Campcodes Online Recruitment Management System 1.0 exposes the admin AJAX endpoint at /admin/ajax.php?action=save_user to unauthenticated remote attackers who can manipulate the id parameter to inject arbitrary SQL. Based on the CVSS 4.0 vector (PR:N/UI:N/AV:N), no authentication or user interaction is required, enabling direct database read, write, and potential availability disruption. A public proof-of-concept exploit is available on GitHub, lowering the skill barrier for exploitation, though EPSS at 0.07% (21st percentile) and absence from CISA KEV indicate no confirmed widespread active exploitation at time of analysis.
SQL injection in Campcodes Online Recruitment Management System 1.0 allows remote attackers to manipulate database queries via the unsanitized `id` parameter in `/admin/ajax.php?action=delete_recruitment_status`. A publicly available proof-of-concept exploit has been disclosed on GitHub. No active exploitation is confirmed by CISA KEV, and EPSS sits at 0.07% (21st percentile), indicating low observed exploitation interest likely reflecting the product's niche deployment footprint rather than difficulty of exploitation.
SQL injection in Campcodes Online Recruitment Management System 1.0 exposes the `/admin/ajax.php?action=save_recruitment_status` endpoint to remote unauthenticated attackers who can manipulate the `ID` parameter to read, modify, or partially disrupt the underlying database. A public proof-of-concept exploit has been disclosed on GitHub, lowering the barrier for opportunistic attacks. No confirmed active exploitation (CISA KEV) has been recorded, and EPSS at 0.09% (25th percentile) reflects minimal observed automated targeting, but the public POC makes internet-facing deployments a realistic target.
CVE-2025-7436 is a critical SQL injection vulnerability in Campcodes Online Recruitment Management System version 1.0, affecting the /admin/ajax.php?action=delete_vacancy endpoint where the ID parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or system compromise. A proof-of-concept exploit has been publicly disclosed, increasing real-world exploitation risk.
SQL injection in Campcodes Online Recruitment Management System 1.0 allows remote attackers to inject malicious SQL via the ID parameter in /admin/view_vacancy.php, potentially leading to low‑impact data leakage or modification. Public exploit code exists, but
SQL injection vulnerability in Campcodes Online Recruitment Management System 1.0 allows unauthenticated remote attackers to manipulate or extract database contents via the ID parameter in /admin/ajax.php?action=save_vacancy. Public exploit code is available, but the CVSS 4.0 score of 5.5 indicates only low impact to confidentiality, integrity, and availability. No active exploitation has been reported in CISA KEV, and EPSS probability is low (0.06%).
SQL injection in Campcodes Online Recruitment Management System 1.0 allows remote attackers to manipulate database records via the ID parameter in /admin/ajax.php?action=delete_application. Public exploit code is available, but no active exploitation has been confirmed by CISA KEV; EPSS indicates a low 0.06% probability of widespread attacks.
CVE-2025-6567 is a critical SQL injection vulnerability in Campcodes Online Recruitment Management System version 1.0, specifically in the Recruitment/admin/view_application.php file where the ID parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of recruitment records. The vulnerability has been publicly disclosed with proof-of-concept code available, and exploitation requires no special privileges or user interaction.
Unrestricted file upload in Campcodes Online Recruitment Management System 1.0 allows authenticated attackers to upload arbitrary PHP files via the /admin/ajax.php?action=save_settings endpoint, leading to remote code execution. A public exploit is available, but no active exploitation has been reported (EPSS 0.12%).
Critical SQL injection vulnerability in Campcodes Online Recruitment Management System version 1.0 affecting the /admin/ajax.php?action=save_application endpoint. An unauthenticated remote attacker can manipulate the position_id parameter to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with proof-of-concept code available, making active exploitation likely.
Critical SQL injection vulnerability in Campcodes Online Recruitment Management System version 1.0, affecting the authentication endpoint at /admin/ajax.php?action=login. An unauthenticated remote attacker can manipulate the Username parameter to execute arbitrary SQL queries, potentially leading to unauthorized access, data exfiltration, or database manipulation. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk.