CVE-2026-112151
HighCVSS 7.3Summary
A SQL injection vulnerability was found in vraj404 Criminal Management System in home.php within the Submission Form. Manipulation of the id/name/offName/crime/dob/arrDate/crimeDate/sex/address/folder/more arguments allows SQL injection. The attack can be performed remotely and a public exploit is available.
Risk Assessment
Unauthorized reading or modification of database data may occur, leading to personal data leakage and integrity compromise. Public exploit availability increases the likelihood of rapid exploitation.
Recommendation
Implement input validation and parameterized SQL queries in home.php and restrict access to the application. Until a patch is released, monitor traffic and block suspicious requests.
Other vulnerabilities in Criminal Management System
See all- CVE-2026-112153High
A vulnerability was detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This affects the function mysqli_error of the file Officers/addOfficer.php of the component Officer Registration Form; manipulation of the argument offName/offID/ID/contact/gender/weapon/role results in SQL injection. The attack can be initiated remotely, and the exploit is now public and may be used.
- CVE-2026-112152High
A security vulnerability has been detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this issue is the function mysqli_query of the file Officers/searchOff.php of the component Search Page; manipulation of the argument Search leads to SQL injection. The attack may be performed from remote, and the exploit has been disclosed publicly and may be used.
- CVE-2026-112150High
A SQL injection vulnerability exists in search.php of vraj404 Criminal-Management-System via manipulation of the Search argument. The attack can be executed remotely and a public exploit has been released.
- CVE-2026-112149High
An unrestricted file upload vulnerability exists in the move_uploaded_file function in home.php of vraj404 Criminal-Management-System via manipulation of the my_img argument. Remote exploitation is possible and a public exploit is available.
Original NVD description (English source)
A weakness has been identified in vraj404 Criminal Management System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this vulnerability is an unknown functionality of the file home.php of the component Submission Form. This manipulation of the argument id/name/offName/crime/dob/arrDate/crimeDate/sex/address/folder/more causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS