CVE-2026-108806: krupalshah EmployeeRecruitmentSystem Forgot Password authprocessing.php mysql_query sql injection
A vulnerability has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the function mysqlquery of the file source/authprocessing.php of the component Forgot Password Handler. Such manipulation of the argument fpemail leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Deployments of krupalshah EmployeeRecruitmentSystem that include the affected Forgot Password Handler in source/authprocessing.php are exposed. The issue affects unsupported products, and the available information does not identify unaffected releases because the product is not versioned.
What does an attacker need to exploit it?
An attacker can launch the attack remotely without privileges or user interaction by manipulating the fpemail argument handled by the forgot-password functionality. Public exploit disclosure means exploitation details may be available to attackers.
What can be done if patching is not immediately possible?
The provided information does not identify a vendor fix or supported release. Restrict or disable public access to the forgot-password functionality, particularly the endpoint that reaches source/authprocessing.php, until the vulnerable code can be removed, replaced, or corrected.
How can I determine whether my deployment is affected?
Inspect source/authprocessing.php and the forgot-password handler for use of mysql_query with SQL constructed from the fpemail argument. Because no version mapping is available, code inspection is necessary to establish exposure.