CVE-2026-85516
HighCVSS 7.3Summary
Vehicle Management System 1.0 by code-projects contains an SQL injection vulnerability in the file /busprofile.php. Manipulation of the busid argument allows remote execution of SQL queries.
Risk Assessment
An attacker can exploit the vulnerability to gain unauthorized access to the database, steal data, or modify system content.
Recommendation
It is recommended to apply patches immediately or implement input validation and parameterized queries to prevent SQL injection attacks.
Other vulnerabilities in Vehicle Management System
See all- CVE-2026-85517Medium
A flaw has been found in code-projects Vehicle Management System 1.0. The impacted element is an unknown function of the file /vehicle_management.sql of the component SQL Database Backup File Handler. Executing a manipulation can lead to information disclosure. It is possible to launch the attack remotely. The exploit has been published and may be used.
- CVE-2024-48245High
Vehicle Management System 1.0 is vulnerable to SQL injection. An unauthenticated user can exploit POST parameters in administrative actions such as booking a vehicle or confirming a booking. The affected parameters include "Booking ID", "Action Name", and "Payment Confirmation ID" in /newvehicle.php and /newdriver.php.
Original NVD description (English source)
A vulnerability was detected in code-projects Vehicle Management System 1.0. The affected element is an unknown function of the file /busprofile.php. Performing a manipulation of the argument busid results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.