# CVE-2026-108805: krupalshah EmployeeRecruitmentSystem SQL injection in login handler

Source: https://junglewise.ai/threats/cve-2026-108805-a-flaw-has-been-found-in-krupalshah-employeerecruitmentsystem-up  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-108805 · Severity: high · CVSS 7.3 · Published 2026-10-12

EmployeeRecruitmentSystem is a web-based recruitment platform that processes employee login credentials. A SQL injection vulnerability in the login component allows attackers to bypass authentication and extract sensitive data by manipulating email or password fields without authentication. The product is no longer maintained by its creator.

Technologies: [Krupalshah EmployeeRecruitmentSystem](https://junglewise.ai/threats/technologies/employeerecruitmentsystem). Vendors: [Krupalshah](https://junglewise.ai/threats/vendors/krupalshah).

## Quick answers

**Is CVE-2026-108805 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108805 being exploited in the wild.

**How severe is CVE-2026-108805?** High severity, with a CVSS score of 7.3, published 12 October 2026.

**Which products and versions are affected?** Krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe.

**Is there a fix for CVE-2026-108805?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-108805 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-108805?** Check whether you run Krupalshah EmployeeRecruitmentSystem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the mysql_query function of /source/loginprocessing.php (the Login Handler component) where email and password parameters are not properly sanitized before SQL query execution. An attacker can inject arbitrary SQL commands remotely via the login form to authenticate as any user, extract database contents, or modify records. The vendor has not responded to disclosure attempts and the product uses continuous delivery, making patch information unavailable.

## Affected products

- krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe

## Timeline

- 2026-10-12: disclosed

## References

- [https://github.com/xiaotian2023/CVE/issues/1](https://github.com/xiaotian2023/CVE/issues/1)
- [https://vuldb.com/cve/CVE-2026-108805](https://vuldb.com/cve/CVE-2026-108805)

## Related threats

- [krupalshah EmployeeRecruitmentSystem SQL injection in requirement update handler](https://junglewise.ai/threats/cve-2026-122038-a-vulnerability-was-identified-in-krupalshah)
- [krupalshah EmployeeRecruitmentSystem SQL injection in Registration Wizard](https://junglewise.ai/threats/cve-2026-116049-a-flaw-has-been-found-in-krupalshah-employeerecruitmentsystem-up)
- [krupalshah EmployeeRecruitmentSystem SQL injection in registration form](https://junglewise.ai/threats/cve-2026-116048-a-vulnerability-was-detected-in-krupalshah)
- [krupalshah EmployeeRecruitmentSystem SQL injection in admin registration](https://junglewise.ai/threats/cve-2026-108807-a-vulnerability-was-found-in-krupalshah)
- [krupalshah EmployeeRecruitmentSystem SQL injection in Forgot Password Handler](https://junglewise.ai/threats/cve-2026-108806-a-vulnerability-has-been-found-in-krupalshah)