CVE-2026-112150
HighCVSS 7.3Summary
A SQL injection vulnerability exists in search.php of vraj404 Criminal-Management-System via manipulation of the Search argument. The attack can be executed remotely and a public exploit has been released.
Risk Assessment
The vulnerability allows remote SQL injection, potentially leading to data leakage or modification in the database. Public exploit availability raises the risk of attack.
Recommendation
Apply parameterized queries and input validation in search.php and restrict access to the application. Until a fix is available, monitor and block suspicious requests.
Other vulnerabilities in Criminal-Management-System
See all- CVE-2026-112153High
A vulnerability was detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This affects the function mysqli_error of the file Officers/addOfficer.php of the component Officer Registration Form; manipulation of the argument offName/offID/ID/contact/gender/weapon/role results in SQL injection. The attack can be initiated remotely, and the exploit is now public and may be used.
- CVE-2026-112152High
A security vulnerability has been detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this issue is the function mysqli_query of the file Officers/searchOff.php of the component Search Page; manipulation of the argument Search leads to SQL injection. The attack may be performed from remote, and the exploit has been disclosed publicly and may be used.
- CVE-2026-112151High
A SQL injection vulnerability was found in vraj404 Criminal Management System in home.php within the Submission Form. Manipulation of the id/name/offName/crime/dob/arrDate/crimeDate/sex/address/folder/more arguments allows SQL injection. The attack can be performed remotely and a public exploit is available.
- CVE-2026-112149High
An unrestricted file upload vulnerability exists in the move_uploaded_file function in home.php of vraj404 Criminal-Management-System via manipulation of the my_img argument. Remote exploitation is possible and a public exploit is available.
Original NVD description (English source)
A security flaw has been discovered in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected is an unknown function of the file search.php. The manipulation of the argument Search results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS