How do I check whether I am affected by CVE-2026-116049?

- Check whether the repository is deployed anywhere by looking for `source/registerform2.php` in the web root - Confirm the deployed commit against `922ff6d208278282e7c8e36d70d9ae356adec9fe`; the sources say versions are not tracked - unknown for anything beyond the file path

What is the fix for CVE-2026-116049?

- No vendor fix is available; the maintainer did not respond and the project is no longer supported - Remove the public deployment or put the registration form behind authentication - Replace the mysql_query calls with parameterized queries before exposing the form again

Who is not affected by CVE-2026-116049?

Not affected if: form-behind-auth, not-deployed.

Live › vulnerability › CVE-2026-116049

Go to dashboard

high7.5Package

EmployeeRecruitmentSystem: SQL injection in registration form lets remote users query the database

The registerform2.php file in krupalshah's EmployeeRecruitmentSystem passes university, institute, branch, degree, status, cpi, semester and experience fields into a SQL query without sanitizing them. A remote attacker can read or change database contents, and a public exploit has been published.

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

7.5

high

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 25, 2026 UTC
Last modified: Oct 25, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-25 09:39 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: No.
Reachable from: internet.
Worst case: Remote attacker reads or alters database contents through the registration form.
CVSS said: 7.5. The facts above say critical; we keep the sources' high until an analyst looks.

Who is affected

Anyone running this EmployeeRecruitmentSystem code with the Registration Wizard form reachable from the network is exposed, since the flawed query takes values straight from the form. Teams that do not run this repository, or that have it offline or behind authentication, are less exposed but should still verify. The sources do not say which PHP versions or database setups are affected.

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-116049

Go to dashboard

high7.5Package

EmployeeRecruitmentSystem: SQL injection in registration form lets remote users query the database

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

7.5

high

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 25, 2026 UTC
Last modified: Oct 25, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-25 09:39 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: No.
Reachable from: internet.
Worst case: Remote attacker reads or alters database contents through the registration form.
CVSS said: 7.5. The facts above say critical; we keep the sources' high until an analyst looks.

Who is affected

Know the next one before it finds you.

Add to Slack

EmployeeRecruitmentSystem: SQL injection in registration form lets remote users query the database

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

EmployeeRecruitmentSystem: SQL injection in registration form lets remote users query the database

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources