The vulnerability is a classic SQL injection in HireFlow's /login and /search endpoints, where user input is concatenated into SQL statements without escaping or parameterization. An attacker can supply a forged username such as admin'-- to bypass authentication, or use a UNION‑based payload on the /search endpoint to retrieve the entire database, including stored user credentials. This flaw permits unauthenticated attackers to gain privileged access or exfiltrate sensitive data, directly compromising confidentiality and integrity of user information.

The flaw is limited to the open‑source HireFlow interview management system, specifically version 1.2, as indicated by the source‑code reference links. No other vendor or product list is included in the CNA data, so the scope is confined to deployments of this exact version.

The CVSS score is 9.8, with an EPSS score of < 1%, and it is not listed in the CISA KEV catalog. Nevertheless, because the attack vector involves unauthenticated input acceptance and the potential to retrieve all database rows, the risk is high. An attacker can exploit the flaw with a simple crafted HTTP request; no special infrastructure or credentials are required, making exploitation feasible and likely if the system is publicly reachable.