CVE-2026-38567 - Vulnerability Analysis

Overview

HireFlow v1.2 contains an SQL injection caused by unsanitized user input concatenated into SQL queries in /login and /search endpoints, letting unauthenticated attackers bypass authentication and extract database contents.

Severity & Score

Impact

Unauthenticated attackers can bypass authentication and extract full database contents, including user credentials, leading to complete data compromise.

Mitigation

Update to the latest version with proper input sanitization and parameterized queries.

References

• https://github.com/StratonWebDesigners/HireFlow
• https://github.com/hijackedamygdala/CVE-Disclosures/tree/main/HireFlow/CVE-2026-38567
• https://www.sourcecodester.com/python/18688/hireflow-%E2%80%93-complete-interview-management-system.html

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner