CVE-2026-112149
HighCVSS 7.3Summary
An unrestricted file upload vulnerability exists in the move_uploaded_file function in home.php of vraj404 Criminal-Management-System via manipulation of the my_img argument. Remote exploitation is possible and a public exploit is available.
Risk Assessment
A malicious file could be uploaded, potentially leading to code execution or system compromise. Public exploit availability increases the risk of exploitation.
Recommendation
Restrict file types and sizes and validate uploaded content in home.php. Until a fix is available, monitor uploads and block suspicious files.
Other vulnerabilities in Criminal-Management-System
See all- CVE-2026-112153High
A vulnerability was detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This affects the function mysqli_error of the file Officers/addOfficer.php of the component Officer Registration Form; manipulation of the argument offName/offID/ID/contact/gender/weapon/role results in SQL injection. The attack can be initiated remotely, and the exploit is now public and may be used.
- CVE-2026-112152High
A security vulnerability has been detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this issue is the function mysqli_query of the file Officers/searchOff.php of the component Search Page; manipulation of the argument Search leads to SQL injection. The attack may be performed from remote, and the exploit has been disclosed publicly and may be used.
- CVE-2026-112151High
A SQL injection vulnerability was found in vraj404 Criminal Management System in home.php within the Submission Form. Manipulation of the id/name/offName/crime/dob/arrDate/crimeDate/sex/address/folder/more arguments allows SQL injection. The attack can be performed remotely and a public exploit is available.
- CVE-2026-112150High
A SQL injection vulnerability exists in search.php of vraj404 Criminal-Management-System via manipulation of the Search argument. The attack can be executed remotely and a public exploit has been released.
Original NVD description (English source)
A vulnerability was identified in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This impacts the function move_uploaded_file of the file home.php. The manipulation of the argument my_img leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS