Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-108806— krupalshah EmployeeRecruitmentSystem Forgot Password authprocessing.php mysql_query sql injection

Quick assessment

Affected
krupalshah EmployeeRecruitmentSystem
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 krupalshah 的 EmployeeRecruitmentSystem 系统中（最高至提交哈希 922ff6d208278282e7c8e36d70d9ae356adec9fe）发现了一个漏洞。受此问题影响的是组件“忘记密码处理器（Forgot Password Handler）”中文件 source/authprocessing.php 内的 mysql_query 函数。对该函数的参数 fpemail 进行特定操纵可导致 SQL 注入漏洞。攻击者可以远程发起攻击。该漏洞的利用方式已公开披露，并可被实际

CVSS 7.3 · High EPSS 0.25% · P16

Affected Version Matrix 1

VendorProduct Version RangeStatus
krupalshah EmployeeRecruitmentSystem 922ff6d208278282e7c8e36d70d9ae356adec9fe affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-108806

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
krupalshah EmployeeRecruitmentSystem Forgot Password authprocessing.php mysql_query sql injection
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the function mysql_query of the file source/authprocessing.php of the component Forgot Password Handler. Such manipulation of the argument fpemail leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
krupalshah EmployeeRecruitmentSystem 922ff6d208278282e7c8e36d70d9ae356adec9fe cpe:2.3:a:krupalshah:employeerecruitmentsystem:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-108806

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-108806

请登录查看更多情报信息。

Proof of Concept for CVE-2026-108806 (1)

Same Patch Batch · krupalshah · 2026-10-12 · 3 CVEs total

CVE-2026-108805 7.3 HIGH krupalshah EmployeeRecruitmentSystem Login loginprocessing.php mysql_query sql injection
CVE-2026-108807 7.3 HIGH krupalshah EmployeeRecruitmentSystem Registration adminregister.php mysql_query sql inject

IV. Related Vulnerabilities

Same product: EmployeeRecruitmentSystem
Same vendor: krupalshah
Same weakness: CWE-89

V. Comments for CVE-2026-108806

No comments yet

Leave a comment