A remote attacker can exploit the registerform3.php file by manipulating the pemail argument to perform SQL injection. This allows execution of arbitrary SQL statements, potentially exposing sensitive data, modifying or deleting database records, or taking full control of the database. The flaw is based on improper handling of user input (CWE-74, CWE-89).

The vulnerability resides in the krupalshah Employee Recruitment System, affecting unknown versions up to commit 922ff6d208278282e7c8e36d70d9ae356adec9fe. Continuous delivery and rolling releases mean that no specific fixed version is identified, and the product is no longer supported by the maintainer.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score is unavailable, so current exploit probability is unclear. The vulnerability can be triggered remotely via standard HTTP request to the registration endpoint, with the pemail parameter as the injection vector. The vendor has not released a patch, and the product is unsupported, which elevates the risk for environments still running it. However, because no exploit has been reported in the KEV list, the immediate threat is moderate and requires remediation to prevent potential data compromise.