Threat database

CVE-2026-116050 is a SQL injection vulnerability in the krupalshah Employee Recruitment System affecting the /source/registerform3.php file's pemail parameter. The vulnerability allows remote attackers to manipulate SQL queries. The product uses continuous delivery with rolling releases, so no specific affected or fixed versions are available. The vendor did not respond to the disclosure and the affected product is no longer supported. The vulnerability has a medium severity score of 6.9 and public exploit details have been disclosed.

CVE-2026-116049 is a SQL injection vulnerability in the krupalshah EmployeeRecruitmentSystem affecting the mysql_query function in /source/registerform2.php. The vulnerability allows remote attackers to manipulate several input parameters, potentially leading to SQL injection. The product uses rolling releases, so specific affected or fixed versions are not available. The vendor did not respond to disclosure and no patch or remediation is currently known. This vulnerability affects unsupported versions of the product.

CVE-2026-116048 is a SQL injection vulnerability in the krupalshah EmployeeRecruitmentSystem affecting the mysql_query function in /source/registerform1.php. The vulnerability allows remote attackers to manipulate multiple input parameters leading to SQL injection. The product uses a rolling release model, so no specific affected or fixed versions are available. The vendor did not respond to disclosure and the affected product is no longer supported. The vulnerability has a CVSS 4.0 score of 6.9 (medium severity).

CVE-2026-108807 is a SQL injection vulnerability in the krupalshah EmployeeRecruitmentSystem affecting the mysql_query function in source/adminregister.php's Registration Handler component. The vulnerability allows remote attackers to manipulate SQL queries. The product uses a rolling release model, and no specific affected versions are provided. The vendor no longer supports this product and did not respond to disclosure attempts. Exploit code has been publicly released. The CVSS 4.0 score is 6.9, indicating medium severity.

CVE-2026-108806 is a SQL injection vulnerability in the krupalshah EmployeeRecruitmentSystem affecting the Forgot Password Handler component. The vulnerability arises from unsafe use of the mysql_query function with the fpemail argument in source/authprocessing.php. It allows remote attackers to manipulate SQL queries. The product lacks versioning and is no longer supported by the maintainer. Public exploit details have been disclosed. No patch or remediation is available.

CVE-2026-108805 is a SQL injection vulnerability in the krupalshah EmployeeRecruitmentSystem affecting the mysql_query function in source/loginprocessing.php. The vulnerability arises from manipulation of the email/password arguments in the Login Handler component. It can be exploited remotely without authentication. The product uses continuous delivery with rolling releases, so no specific affected or fixed versions are available. The vendor did not respond to disclosure and no patch information is available. This vulnerability affects unsupported versions of the product.