Mjob - Mjobtime - CRITICAL - CVE-2026-9209. The mJobTime application, specifically build 15.7.3.32, features an unauthenticated SQL execution vulnerability found in the Login.aspx admin panel. This flaw allows attackers to exploit the runQueryButton postback and exportSqlQuery_Server PageMethod, executing arbitrary SQL commands against the underlying Sybase SQL Anywhere database without proper server-side authentication. By leveraging this vulnerability, attackers can invoke sensitive functions, such as xp_cmdshell and xp_read_file, leading to pre-authentication remote code execution with LocalSystem privileges through a single, crafted HTTP request. BADGES: 👾 EXPLOITED | 🟡 PoC | SecurityVulnerability.io