CVE-2026-108805

{
  "etk_id": "ETK-2026-1325",
  "cve_id": "CVE-2026-108805",
  "display_id": "CVE-2026-108805",
  "ghsa_id": "GHSA-77q5-xc5r-c7qh",
  "euvd_id": "EUVD-2026-97240",
  "status": "published",
  "anchor_state": "anchored",
  "title": "SQL injection in EmployeeRecruitmentSystem login handler",
  "summary": "EmployeeRecruitmentSystem revisions through commit 922ff6d208278282e7c8e36d70d9ae356adec9fe process login email and password input unsafely in the login handler. A remote attacker able to submit requests to that handler may alter the database query executed during login.",
  "mitigation": "Remove or replace this unsupported deployment where possible. Until it is replaced or locally corrected, restrict network access to the login handler and update its database access to use parameterized queries.",
  "vendor": "krupalshah",
  "product": "EmployeeRecruitmentSystem",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "922ff6d208278282e7c8e36d70d9ae356adec9fe"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "EmployeeRecruitmentSystem",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
  "epss_score": 0.0025,
  "epss_percentile": 0.1591,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 14.660455333333333,
  "t0_at": "2026-10-12T05:45:20.515000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-12T05:45:20.515000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-12T05:45:20.515000+00:00",
      "url": "https://github.com/advisories/GHSA-77q5-xc5r-c7qh"
    }
  }
}