CVE-2026-116048

Name of the Vulnerable Software and Affected Versions krupalshah EmployeeRecruitmentSystem versions up to 922ff6d208278282e7c8e36d70d9ae356adec9fe

Description An SQL injection issue exists in the Registration component within the mysql query() function of the /source/registerform1.php file. A remote attacker can exploit this by manipulating the firstname, middlename, lastname, gender, birthdate, state, statespecify, city, or cityspecify arguments. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database.

Recommendations As a temporary workaround, restrict access to the /source/registerform1.php file or disable the Registration component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.