Is CVE-2026-108806 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108806 being exploited in the wild.

How severe is CVE-2026-108806?

High severity, with a CVSS score of 7.3, published 12 October 2026.

Which products and versions are affected?

Krupalshah EmployeeRecruitmentSystem V1.0 and earlier (master branch, no version tags).

How is CVE-2026-108806 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-108806?

Check whether you run Krupalshah EmployeeRecruitmentSystem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108806: krupalshah EmployeeRecruitmentSystem SQL injection in Forgot Password Handler

CVE-2026-108806 · Severity: high · CVSS 7.3 · Published 2026-10-12

EmployeeRecruitmentSystem is a recruitment platform that manages employee and candidate data. An unauthenticated attacker can exploit a SQL injection vulnerability in the public "forgot password" feature to extract the entire database, including employee email addresses, plaintext passwords, and candidate profiles without requiring any credentials or authentication.

Technologies: Krupalshah EmployeeRecruitmentSystem. Vendors: Krupalshah.

Quick answers

Is CVE-2026-108806 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108806 being exploited in the wild.
How severe is CVE-2026-108806?: High severity, with a CVSS score of 7.3, published 12 October 2026.
Which products and versions are affected?: Krupalshah EmployeeRecruitmentSystem V1.0 and earlier (master branch, no version tags).
Is there a fix for CVE-2026-108806?: No fixed version is recorded yet. Discontinue use of this product immediately as it is no longer maintained by the vendor since 2016. If continued use is necessary, implement a Web Application Firewall (WAF) with SQL injection detection rules and restrict network access to the /source/authprocessing.php endpoint to trusted IP addresses only. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-108806 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-108806?: Check whether you run Krupalshah EmployeeRecruitmentSystem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Discontinue use of this product immediately as it is no longer maintained by the vendor since 2016. If continued use is necessary, implement a Web Application Firewall (WAF) with SQL injection detection rules and restrict network access to the /source/authprocessing.php endpoint to trusted IP addresses only.

Technical details

A SQL injection vulnerability exists in source/authprocessing.php where the POST parameter 'fpemail' is concatenated directly into a MySQL SELECT query without sanitization or prepared statements, allowing multiple injection techniques (boolean-based blind, error-based via mysql_error() leakage, time-based blind, and UNION queries). The vulnerable endpoint is publicly accessible without authentication, allowing any remote attacker to fully enumerate and extract the database. While the product is no longer maintained by the vendor since 2016, no official patch is available.

Affected products

krupalshah EmployeeRecruitmentSystem V1.0 and earlier (master branch, no version tags)

Timeline

2026-09-07: disclosed: Public disclosure on GitHub
2026-10-12: advisory: CVE-2026-108806 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.