# CVE-2026-108806: krupalshah EmployeeRecruitmentSystem SQL injection in Forgot Password Handler

Source: https://junglewise.ai/threats/cve-2026-108806-a-vulnerability-has-been-found-in-krupalshah  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-108806 · Severity: high · CVSS 7.3 · Published 2026-10-12

EmployeeRecruitmentSystem is a recruitment platform that manages employee and candidate data. An unauthenticated attacker can exploit a SQL injection vulnerability in the public "forgot password" feature to extract the entire database, including employee email addresses, plaintext passwords, and candidate profiles without requiring any credentials or authentication.

Technologies: [Krupalshah EmployeeRecruitmentSystem](https://junglewise.ai/threats/technologies/employeerecruitmentsystem). Vendors: [Krupalshah](https://junglewise.ai/threats/vendors/krupalshah).

## Quick answers

**Is CVE-2026-108806 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108806 being exploited in the wild.

**How severe is CVE-2026-108806?** High severity, with a CVSS score of 7.3, published 12 October 2026.

**Which products and versions are affected?** Krupalshah EmployeeRecruitmentSystem V1.0 and earlier (master branch, no version tags).

**Is there a fix for CVE-2026-108806?** No fixed version is recorded yet. Discontinue use of this product immediately as it is no longer maintained by the vendor since 2016. If continued use is necessary, implement a Web Application Firewall (WAF) with SQL injection detection rules and restrict network access to the /source/authprocessing.php endpoint to trusted IP addresses only. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-108806 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-108806?** Check whether you run Krupalshah EmployeeRecruitmentSystem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Discontinue use of this product immediately as it is no longer maintained by the vendor since 2016. If continued use is necessary, implement a Web Application Firewall (WAF) with SQL injection detection rules and restrict network access to the /source/authprocessing.php endpoint to trusted IP addresses only.

## Technical details

A SQL injection vulnerability exists in source/authprocessing.php where the POST parameter 'fpemail' is concatenated directly into a MySQL SELECT query without sanitization or prepared statements, allowing multiple injection techniques (boolean-based blind, error-based via mysql_error() leakage, time-based blind, and UNION queries). The vulnerable endpoint is publicly accessible without authentication, allowing any remote attacker to fully enumerate and extract the database. While the product is no longer maintained by the vendor since 2016, no official patch is available.

## Affected products

- krupalshah EmployeeRecruitmentSystem V1.0 and earlier (master branch, no version tags)

## Timeline

- 2026-09-07: disclosed: Public disclosure on GitHub
- 2026-10-12: advisory: CVE-2026-108806 published

## References

- [https://github.com/xiaotian2023/CVE/issues/2](https://github.com/xiaotian2023/CVE/issues/2)
- [https://vuldb.com/cve/CVE-2026-108806](https://vuldb.com/cve/CVE-2026-108806)

## Related threats

- [krupalshah EmployeeRecruitmentSystem SQL injection in requirement update handler](https://junglewise.ai/threats/cve-2026-122038-a-vulnerability-was-identified-in-krupalshah)
- [krupalshah EmployeeRecruitmentSystem SQL injection in Registration Wizard](https://junglewise.ai/threats/cve-2026-116049-a-flaw-has-been-found-in-krupalshah-employeerecruitmentsystem-up)
- [krupalshah EmployeeRecruitmentSystem SQL injection in registration form](https://junglewise.ai/threats/cve-2026-116048-a-vulnerability-was-detected-in-krupalshah)
- [krupalshah EmployeeRecruitmentSystem SQL injection in admin registration](https://junglewise.ai/threats/cve-2026-108807-a-vulnerability-was-found-in-krupalshah)
- [krupalshah EmployeeRecruitmentSystem SQL injection in login handler](https://junglewise.ai/threats/cve-2026-108805-a-flaw-has-been-found-in-krupalshah-employeerecruitmentsystem-up)