CVE-2026-85517
MediumCVSS 5.3Summary
A flaw has been found in code-projects Vehicle Management System 1.0. The impacted element is an unknown function of the file /vehicle_management.sql of the component SQL Database Backup File Handler. Executing a manipulation can lead to information disclosure. It is possible to launch the attack remotely. The exploit has been published and may be used.
Risk Assessment
The risk is the potential for remote information disclosure, which could compromise the confidentiality of system data. The public exploit increases the risk of exploitation.
Recommendation
It is recommended to immediately upgrade Vehicle Management System to a version that includes fixes. Also, restrict access to database backup files.
Other vulnerabilities in Vehicle Management System
See all- CVE-2026-85516High
Vehicle Management System 1.0 by code-projects contains an SQL injection vulnerability in the file /busprofile.php. Manipulation of the busid argument allows remote execution of SQL queries.
- CVE-2024-48245High
Vehicle Management System 1.0 is vulnerable to SQL injection. An unauthenticated user can exploit POST parameters in administrative actions such as booking a vehicle or confirming a booking. The affected parameters include "Booking ID", "Action Name", and "Payment Confirmation ID" in /newvehicle.php and /newdriver.php.
Original NVD description (English source)
A flaw has been found in code-projects Vehicle Management System 1.0. The impacted element is an unknown function of the file /vehicle_management.sql of the component SQL Database Backup File Handler. Executing a manipulation can lead to information disclosure. It is possible to launch the attack remotely. The exploit has been published and may be used.