CVE-2026-38567

HireFlow v1.2 is vulnerable to SQL injection in the /login and /search endpoints. User-supplied input is concatenated directly into SQL queries without parameterization. An unauthenticated attacker can bypass authentication by supplying a crafted username (e.g. admin'--) or extract the full contents of the database including user credentials via UNION-based injection at the /search endpoint.

• CWE-89

• https://github.com/StratonWebDesigners/HireFlow
• https://github.com/hijackedamygdala/CVE-Disclosures/tree/main/HireFlow/CVE-2026-38567
• https://www.sourcecodester.com/python/18688/hireflow-%E2%80%93-complete-interview-management-system.html
• https://github.com/hijackedamygdala/CVE-Disclosures/tree/main/HireFlow/CVE-2026-38567

Published

May 11, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-38530A Broken Object-Level Authorization (BOLA) in the /Controlle…8.1
• CVE-2026-38532A Broken Object-Level Authorization (BOLA) in the /Contact/P…8.1
• CVE-2026-38533An improper authorization vulnerability in the /api/v1/users…6.5
• CVE-2026-3854An improper neutralization of special elements vulnerability…8.8
• CVE-2026-3856IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2…9.1
• CVE-2026-38566HireFlow v1.2 does not implement CSRF token validation on an…8.1
• CVE-2026-38568HireFlow v1.2 is vulnerable to Incorrect Access Control. The…8.1
• CVE-2026-38569HireFlow v1.2 is vulnerable to Cross Site Scripting (XSS) in…5.4
• CVE-2026-3857GitLab has remediated an issue in GitLab CE/EE affecting all…8.8
• CVE-2026-38570bacnet_stack 1.3.1 contains an Out-of-bounds Read in bacnet_…7.5
• CVE-2026-38571Cleartext storage and exposure of WPA2 credentials, and miss…4.6
• CVE-2026-38579Multiple reflected Cross-Site Scripting (XSS) vulnerabilitie…6.1