CVE-2024-12968

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical was found in code-projects Job Recruitment 1.0. Affected by this vulnerability is the function edit_jobpost of the file /_parse/_all_edits.php. The manipulation of the argument jobtype leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
code-projects	Job Recruitment	1.0

References

https://code-projects.org/Product
https://github.com/705298066/cve/blob/main/sql-1-kzk.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.289333Permissions Required, VDB Entry
https://vuldb.com/?id.289333Third Party Advisory, VDB Entry
https://vuldb.com/?submit.469021Third Party Advisory, VDB Entry
https://github.com/705298066/cve/blob/main/sql-1-kzk.mdExploit, Third Party Advisory

Timeline

Published: Dec 26, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-129699.8A vulnerability, which was classified as critical, has been found in code-projects Hospital Management System 1.0. Affected by this issue is CVE-2024-12977.2Loomio version 2.22.0 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to OS Comma CVE-2024-129703.9Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TUBITAK BILGEM Pardus OS My Comp CVE-2024-129718.8Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection.This issue affects Pandora FMS from CVE-2024-129724.3Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akinsoft OctoCloud allows Cross CVE-2024-129734.7Origin Validation Error vulnerability in Akinsoft OctoCloud allows HTTP Response Splitting, CAPEC - 87 - Forceful Browsing. This issue affe CVE-2024-129744.3Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akinsoft ProKuaför allows Cross CVE-2024-129751.0A buffer overread can occur in the CPC application when operating in full duplex SPI upon receiving an invalid packet over the SPI interface CVE-2024-129769.8A vulnerability, which was classified as critical, has been found in CodeZips Hospital Management System 1.0. Affected by this issue is some CVE-2024-129779.8A vulnerability, which was classified as critical, was found in PHPGurukul Complaint Management System 1.0. This affects an unknown part of CVE-2024-129787.5A vulnerability has been found in code-projects Job Recruitment 1.0 and classified as critical. This vulnerability affects the function add_CVE-2024-129796.1A vulnerability was found in code-projects Job Recruitment 1.0 and classified as problematic. This issue affects the function cn_update of t