Search
Find a vulnerability
Search criteria
10 vulnerabilities by vraj404
CVE-2026-112153 (GCVE-0-2026-112153)
Vulnerability from nvd – Published: 2026-10-19 15:30 – Updated: 2026-10-19 16:37
VLAI
EPSS
VEX
Title
vraj404 Criminal-Management-System Officer Registration Form addOfficer.php mysqli_error sql injection
Summary
A vulnerability was detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This affects the function mysqli_error of the file Officers/addOfficer.php of the component Officer Registration Form. Performing a manipulation of the argument offName/offID/ID/contact/gender/weapon/role results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 16:37 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422260 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/422260/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112153 | third-party-advisory |
| https://vuldb.com/submit/1014023 | third-party-advisory |
| https://github.com/vraj404/Criminal-Management-Sy… | exploitissue-tracking |
| https://github.com/vraj404/Criminal-Management-System/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| vraj404 | Criminal-Management-System |
Affected:
2808d057e7ddc5295519a487365b0cacfd0ba8c4
cpe:2.3:a:vraj404:criminal-management-system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112153",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T16:37:37.803515Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:37:50.313Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:vraj404:criminal-management-system:*:*:*:*:*:*:*:*"
],
"modules": [
"Officer Registration Form"
],
"product": "Criminal-Management-System",
"vendor": "vraj404",
"versions": [
{
"status": "affected",
"version": "2808d057e7ddc5295519a487365b0cacfd0ba8c4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Quanqie (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This affects the function mysqli_error of the file Officers/addOfficer.php of the component Officer Registration Form. Performing a manipulation of the argument offName/offID/ID/contact/gender/weapon/role results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T15:30:16.983Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422260 | vraj404 Criminal-Management-System Officer Registration Form addOfficer.php mysqli_error sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/422260"
},
{
"name": "VDB-422260 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422260/cti"
},
{
"name": "CVE-2026-112153 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112153"
},
{
"name": "Submit #1014023 | vraj404 Criminal-Management-System 2808d057e7ddc5295519a487365b0cacfd0ba8c4 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1014023"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/vraj404/Criminal-Management-System/issues/5"
},
{
"tags": [
"product"
],
"url": "https://github.com/vraj404/Criminal-Management-System/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-19T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-19T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-19T07:56:05.000Z",
"value": "VulDB entry last update"
}
],
"title": "vraj404 Criminal-Management-System Officer Registration Form addOfficer.php mysqli_error sql injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112153",
"datePublished": "2026-10-19T15:30:16.983Z",
"dateReserved": "2026-10-19T05:50:41.363Z",
"dateUpdated": "2026-10-19T16:37:50.313Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112152 (GCVE-0-2026-112152)
Vulnerability from nvd – Published: 2026-10-19 15:15 – Updated: 2026-10-19 16:33
VLAI
EPSS
VEX
Title
vraj404 Criminal-Management-System Search searchOff.php mysqli_query sql injection
Summary
A security vulnerability has been detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this issue is the function mysqli_query of the file Officers/searchOff.php of the component Search Page. Such manipulation of the argument Search leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 15:46 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422259 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/422259/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112152 | third-party-advisory |
| https://vuldb.com/submit/1014022 | third-party-advisory |
| https://github.com/vraj404/Criminal-Management-Sy… | exploitissue-tracking |
| https://github.com/vraj404/Criminal-Management-System/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| vraj404 | Criminal-Management-System |
Affected:
2808d057e7ddc5295519a487365b0cacfd0ba8c4
cpe:2.3:a:vraj404:criminal-management-system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112152",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T15:46:49.048485Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:33:54.301Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:vraj404:criminal-management-system:*:*:*:*:*:*:*:*"
],
"modules": [
"Search Page"
],
"product": "Criminal-Management-System",
"vendor": "vraj404",
"versions": [
{
"status": "affected",
"version": "2808d057e7ddc5295519a487365b0cacfd0ba8c4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Quanqie (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this issue is the function mysqli_query of the file Officers/searchOff.php of the component Search Page. Such manipulation of the argument Search leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T15:15:12.996Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422259 | vraj404 Criminal-Management-System Search searchOff.php mysqli_query sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/422259"
},
{
"name": "VDB-422259 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422259/cti"
},
{
"name": "CVE-2026-112152 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112152"
},
{
"name": "Submit #1014022 | vraj404 Criminal-Management-System 2808d057e7ddc5295519a487365b0cacfd0ba8c4 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1014022"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/vraj404/Criminal-Management-System/issues/4"
},
{
"tags": [
"product"
],
"url": "https://github.com/vraj404/Criminal-Management-System/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-19T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-19T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-19T07:56:01.000Z",
"value": "VulDB entry last update"
}
],
"title": "vraj404 Criminal-Management-System Search searchOff.php mysqli_query sql injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112152",
"datePublished": "2026-10-19T15:15:12.996Z",
"dateReserved": "2026-10-19T05:50:37.864Z",
"dateUpdated": "2026-10-19T16:33:54.301Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112151 (GCVE-0-2026-112151)
Vulnerability from nvd – Published: 2026-10-19 15:00 – Updated: 2026-10-19 17:44
VLAI
EPSS
VEX
Title
vraj404 Criminal Management System Submission Form home.php sql injection
Summary
A weakness has been identified in vraj404 Criminal Management System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this vulnerability is an unknown functionality of the file home.php of the component Submission Form. This manipulation of the argument id/name/offName/crime/dob/arrDate/crimeDate/sex/address/folder/more causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 17:44 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422258 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/422258/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112151 | third-party-advisory |
| https://vuldb.com/submit/1014017 | third-party-advisory |
| https://github.com/vraj404/Criminal-Management-Sy… | exploitissue-tracking |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| vraj404 | Criminal Management System |
Affected:
2808d057e7ddc5295519a487365b0cacfd0ba8c4
cpe:2.3:a:vraj404:criminal_management_system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112151",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T17:44:17.696908Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T17:44:38.782Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:vraj404:criminal_management_system:*:*:*:*:*:*:*:*"
],
"modules": [
"Submission Form"
],
"product": "Criminal Management System",
"vendor": "vraj404",
"versions": [
{
"status": "affected",
"version": "2808d057e7ddc5295519a487365b0cacfd0ba8c4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "SoyaBean (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in vraj404 Criminal Management System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this vulnerability is an unknown functionality of the file home.php of the component Submission Form. This manipulation of the argument id/name/offName/crime/dob/arrDate/crimeDate/sex/address/folder/more causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T15:00:14.288Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422258 | vraj404 Criminal Management System Submission Form home.php sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/422258"
},
{
"name": "VDB-422258 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422258/cti"
},
{
"name": "CVE-2026-112151 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112151"
},
{
"name": "Submit #1014017 | vraj404 Criminal-Management-System 2808d057e7ddc5295519a487365b0cacfd0ba8c4 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1014017"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/vraj404/Criminal-Management-System/issues/3"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-19T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-19T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-19T07:55:57.000Z",
"value": "VulDB entry last update"
}
],
"title": "vraj404 Criminal Management System Submission Form home.php sql injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112151",
"datePublished": "2026-10-19T15:00:14.288Z",
"dateReserved": "2026-10-19T05:50:34.195Z",
"dateUpdated": "2026-10-19T17:44:38.782Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112150 (GCVE-0-2026-112150)
Vulnerability from nvd – Published: 2026-10-19 14:45 – Updated: 2026-10-19 14:45
VLAI
EPSS
VEX
Title
vraj404 Criminal-Management-System search.php sql injection
Summary
A security flaw has been discovered in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected is an unknown function of the file search.php. The manipulation of the argument Search results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422257 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/422257/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112150 | third-party-advisory |
| https://vuldb.com/submit/1014016 | third-party-advisory |
| https://github.com/vraj404/Criminal-Management-Sy… | exploitissue-tracking |
| https://github.com/vraj404/Criminal-Management-System/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| vraj404 | Criminal-Management-System |
Affected:
2808d057e7ddc5295519a487365b0cacfd0ba8c4
cpe:2.3:a:vraj404:criminal-management-system:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:vraj404:criminal-management-system:*:*:*:*:*:*:*:*"
],
"product": "Criminal-Management-System",
"vendor": "vraj404",
"versions": [
{
"status": "affected",
"version": "2808d057e7ddc5295519a487365b0cacfd0ba8c4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "SoyaBean (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected is an unknown function of the file search.php. The manipulation of the argument Search results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T14:45:18.145Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422257 | vraj404 Criminal-Management-System search.php sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/422257"
},
{
"name": "VDB-422257 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422257/cti"
},
{
"name": "CVE-2026-112150 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112150"
},
{
"name": "Submit #1014016 | vraj404 Criminal-Management-System 2808d057e7ddc5295519a487365b0cacfd0ba8c4 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1014016"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/vraj404/Criminal-Management-System/issues/2"
},
{
"tags": [
"product"
],
"url": "https://github.com/vraj404/Criminal-Management-System/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-19T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-19T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-19T07:55:53.000Z",
"value": "VulDB entry last update"
}
],
"title": "vraj404 Criminal-Management-System search.php sql injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112150",
"datePublished": "2026-10-19T14:45:18.145Z",
"dateReserved": "2026-10-19T05:50:30.642Z",
"dateUpdated": "2026-10-19T14:45:18.145Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112149 (GCVE-0-2026-112149)
Vulnerability from nvd – Published: 2026-10-19 14:30 – Updated: 2026-10-19 16:44
VLAI
EPSS
VEX
Title
vraj404 Criminal-Management-System home.php move_uploaded_file unrestricted upload
Summary
A vulnerability was identified in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This impacts the function move_uploaded_file of the file home.php. The manipulation of the argument my_img leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 16:44 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422256 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/422256/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112149 | third-party-advisory |
| https://vuldb.com/submit/1014014 | third-party-advisory |
| https://github.com/vraj404/Criminal-Management-Sy… | exploitissue-tracking |
| https://github.com/vraj404/Criminal-Management-System/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| vraj404 | Criminal-Management-System |
Affected:
2808d057e7ddc5295519a487365b0cacfd0ba8c4
cpe:2.3:a:vraj404:criminal-management-system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112149",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T16:44:28.598914Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:44:41.590Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:vraj404:criminal-management-system:*:*:*:*:*:*:*:*"
],
"product": "Criminal-Management-System",
"vendor": "vraj404",
"versions": [
{
"status": "affected",
"version": "2808d057e7ddc5295519a487365b0cacfd0ba8c4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Wuwj (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This impacts the function move_uploaded_file of the file home.php. The manipulation of the argument my_img leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "Unrestricted Upload",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T14:30:16.739Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422256 | vraj404 Criminal-Management-System home.php move_uploaded_file unrestricted upload",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/422256"
},
{
"name": "VDB-422256 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422256/cti"
},
{
"name": "CVE-2026-112149 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112149"
},
{
"name": "Submit #1014014 | vraj404 Criminal-Management-System 2808d057e7ddc5295519a487365b0cacfd0ba8c4 Unrestricted Upload",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1014014"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/vraj404/Criminal-Management-System/issues/1"
},
{
"tags": [
"product"
],
"url": "https://github.com/vraj404/Criminal-Management-System/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-19T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-19T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-19T07:55:49.000Z",
"value": "VulDB entry last update"
}
],
"title": "vraj404 Criminal-Management-System home.php move_uploaded_file unrestricted upload",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112149",
"datePublished": "2026-10-19T14:30:16.739Z",
"dateReserved": "2026-10-19T05:50:26.730Z",
"dateUpdated": "2026-10-19T16:44:41.590Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112153 (GCVE-0-2026-112153)
Vulnerability from cvelistv5 – Published: 2026-10-19 15:30 – Updated: 2026-10-19 16:37
VLAI
EPSS
VEX
Title
vraj404 Criminal-Management-System Officer Registration Form addOfficer.php mysqli_error sql injection
Summary
A vulnerability was detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This affects the function mysqli_error of the file Officers/addOfficer.php of the component Officer Registration Form. Performing a manipulation of the argument offName/offID/ID/contact/gender/weapon/role results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 16:37 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422260 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/422260/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112153 | third-party-advisory |
| https://vuldb.com/submit/1014023 | third-party-advisory |
| https://github.com/vraj404/Criminal-Management-Sy… | exploitissue-tracking |
| https://github.com/vraj404/Criminal-Management-System/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| vraj404 | Criminal-Management-System |
Affected:
2808d057e7ddc5295519a487365b0cacfd0ba8c4
cpe:2.3:a:vraj404:criminal-management-system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112153",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T16:37:37.803515Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:37:50.313Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:vraj404:criminal-management-system:*:*:*:*:*:*:*:*"
],
"modules": [
"Officer Registration Form"
],
"product": "Criminal-Management-System",
"vendor": "vraj404",
"versions": [
{
"status": "affected",
"version": "2808d057e7ddc5295519a487365b0cacfd0ba8c4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Quanqie (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This affects the function mysqli_error of the file Officers/addOfficer.php of the component Officer Registration Form. Performing a manipulation of the argument offName/offID/ID/contact/gender/weapon/role results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T15:30:16.983Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422260 | vraj404 Criminal-Management-System Officer Registration Form addOfficer.php mysqli_error sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/422260"
},
{
"name": "VDB-422260 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422260/cti"
},
{
"name": "CVE-2026-112153 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112153"
},
{
"name": "Submit #1014023 | vraj404 Criminal-Management-System 2808d057e7ddc5295519a487365b0cacfd0ba8c4 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1014023"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/vraj404/Criminal-Management-System/issues/5"
},
{
"tags": [
"product"
],
"url": "https://github.com/vraj404/Criminal-Management-System/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-19T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-19T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-19T07:56:05.000Z",
"value": "VulDB entry last update"
}
],
"title": "vraj404 Criminal-Management-System Officer Registration Form addOfficer.php mysqli_error sql injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112153",
"datePublished": "2026-10-19T15:30:16.983Z",
"dateReserved": "2026-10-19T05:50:41.363Z",
"dateUpdated": "2026-10-19T16:37:50.313Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112152 (GCVE-0-2026-112152)
Vulnerability from cvelistv5 – Published: 2026-10-19 15:15 – Updated: 2026-10-19 16:33
VLAI
EPSS
VEX
Title
vraj404 Criminal-Management-System Search searchOff.php mysqli_query sql injection
Summary
A security vulnerability has been detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this issue is the function mysqli_query of the file Officers/searchOff.php of the component Search Page. Such manipulation of the argument Search leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 15:46 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422259 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/422259/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112152 | third-party-advisory |
| https://vuldb.com/submit/1014022 | third-party-advisory |
| https://github.com/vraj404/Criminal-Management-Sy… | exploitissue-tracking |
| https://github.com/vraj404/Criminal-Management-System/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| vraj404 | Criminal-Management-System |
Affected:
2808d057e7ddc5295519a487365b0cacfd0ba8c4
cpe:2.3:a:vraj404:criminal-management-system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112152",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T15:46:49.048485Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:33:54.301Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:vraj404:criminal-management-system:*:*:*:*:*:*:*:*"
],
"modules": [
"Search Page"
],
"product": "Criminal-Management-System",
"vendor": "vraj404",
"versions": [
{
"status": "affected",
"version": "2808d057e7ddc5295519a487365b0cacfd0ba8c4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Quanqie (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this issue is the function mysqli_query of the file Officers/searchOff.php of the component Search Page. Such manipulation of the argument Search leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T15:15:12.996Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422259 | vraj404 Criminal-Management-System Search searchOff.php mysqli_query sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/422259"
},
{
"name": "VDB-422259 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422259/cti"
},
{
"name": "CVE-2026-112152 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112152"
},
{
"name": "Submit #1014022 | vraj404 Criminal-Management-System 2808d057e7ddc5295519a487365b0cacfd0ba8c4 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1014022"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/vraj404/Criminal-Management-System/issues/4"
},
{
"tags": [
"product"
],
"url": "https://github.com/vraj404/Criminal-Management-System/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-19T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-19T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-19T07:56:01.000Z",
"value": "VulDB entry last update"
}
],
"title": "vraj404 Criminal-Management-System Search searchOff.php mysqli_query sql injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112152",
"datePublished": "2026-10-19T15:15:12.996Z",
"dateReserved": "2026-10-19T05:50:37.864Z",
"dateUpdated": "2026-10-19T16:33:54.301Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112151 (GCVE-0-2026-112151)
Vulnerability from cvelistv5 – Published: 2026-10-19 15:00 – Updated: 2026-10-19 17:44
VLAI
EPSS
VEX
Title
vraj404 Criminal Management System Submission Form home.php sql injection
Summary
A weakness has been identified in vraj404 Criminal Management System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this vulnerability is an unknown functionality of the file home.php of the component Submission Form. This manipulation of the argument id/name/offName/crime/dob/arrDate/crimeDate/sex/address/folder/more causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 17:44 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422258 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/422258/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112151 | third-party-advisory |
| https://vuldb.com/submit/1014017 | third-party-advisory |
| https://github.com/vraj404/Criminal-Management-Sy… | exploitissue-tracking |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| vraj404 | Criminal Management System |
Affected:
2808d057e7ddc5295519a487365b0cacfd0ba8c4
cpe:2.3:a:vraj404:criminal_management_system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112151",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T17:44:17.696908Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T17:44:38.782Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:vraj404:criminal_management_system:*:*:*:*:*:*:*:*"
],
"modules": [
"Submission Form"
],
"product": "Criminal Management System",
"vendor": "vraj404",
"versions": [
{
"status": "affected",
"version": "2808d057e7ddc5295519a487365b0cacfd0ba8c4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "SoyaBean (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in vraj404 Criminal Management System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this vulnerability is an unknown functionality of the file home.php of the component Submission Form. This manipulation of the argument id/name/offName/crime/dob/arrDate/crimeDate/sex/address/folder/more causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T15:00:14.288Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422258 | vraj404 Criminal Management System Submission Form home.php sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/422258"
},
{
"name": "VDB-422258 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422258/cti"
},
{
"name": "CVE-2026-112151 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112151"
},
{
"name": "Submit #1014017 | vraj404 Criminal-Management-System 2808d057e7ddc5295519a487365b0cacfd0ba8c4 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1014017"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/vraj404/Criminal-Management-System/issues/3"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-19T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-19T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-19T07:55:57.000Z",
"value": "VulDB entry last update"
}
],
"title": "vraj404 Criminal Management System Submission Form home.php sql injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112151",
"datePublished": "2026-10-19T15:00:14.288Z",
"dateReserved": "2026-10-19T05:50:34.195Z",
"dateUpdated": "2026-10-19T17:44:38.782Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112150 (GCVE-0-2026-112150)
Vulnerability from cvelistv5 – Published: 2026-10-19 14:45 – Updated: 2026-10-19 14:45
VLAI
EPSS
VEX
Title
vraj404 Criminal-Management-System search.php sql injection
Summary
A security flaw has been discovered in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected is an unknown function of the file search.php. The manipulation of the argument Search results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422257 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/422257/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112150 | third-party-advisory |
| https://vuldb.com/submit/1014016 | third-party-advisory |
| https://github.com/vraj404/Criminal-Management-Sy… | exploitissue-tracking |
| https://github.com/vraj404/Criminal-Management-System/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| vraj404 | Criminal-Management-System |
Affected:
2808d057e7ddc5295519a487365b0cacfd0ba8c4
cpe:2.3:a:vraj404:criminal-management-system:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:vraj404:criminal-management-system:*:*:*:*:*:*:*:*"
],
"product": "Criminal-Management-System",
"vendor": "vraj404",
"versions": [
{
"status": "affected",
"version": "2808d057e7ddc5295519a487365b0cacfd0ba8c4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "SoyaBean (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected is an unknown function of the file search.php. The manipulation of the argument Search results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T14:45:18.145Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422257 | vraj404 Criminal-Management-System search.php sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/422257"
},
{
"name": "VDB-422257 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422257/cti"
},
{
"name": "CVE-2026-112150 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112150"
},
{
"name": "Submit #1014016 | vraj404 Criminal-Management-System 2808d057e7ddc5295519a487365b0cacfd0ba8c4 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1014016"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/vraj404/Criminal-Management-System/issues/2"
},
{
"tags": [
"product"
],
"url": "https://github.com/vraj404/Criminal-Management-System/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-19T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-19T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-19T07:55:53.000Z",
"value": "VulDB entry last update"
}
],
"title": "vraj404 Criminal-Management-System search.php sql injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112150",
"datePublished": "2026-10-19T14:45:18.145Z",
"dateReserved": "2026-10-19T05:50:30.642Z",
"dateUpdated": "2026-10-19T14:45:18.145Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112149 (GCVE-0-2026-112149)
Vulnerability from cvelistv5 – Published: 2026-10-19 14:30 – Updated: 2026-10-19 16:44
VLAI
EPSS
VEX
Title
vraj404 Criminal-Management-System home.php move_uploaded_file unrestricted upload
Summary
A vulnerability was identified in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This impacts the function move_uploaded_file of the file home.php. The manipulation of the argument my_img leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 16:44 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422256 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/422256/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112149 | third-party-advisory |
| https://vuldb.com/submit/1014014 | third-party-advisory |
| https://github.com/vraj404/Criminal-Management-Sy… | exploitissue-tracking |
| https://github.com/vraj404/Criminal-Management-System/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| vraj404 | Criminal-Management-System |
Affected:
2808d057e7ddc5295519a487365b0cacfd0ba8c4
cpe:2.3:a:vraj404:criminal-management-system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112149",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T16:44:28.598914Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:44:41.590Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:vraj404:criminal-management-system:*:*:*:*:*:*:*:*"
],
"product": "Criminal-Management-System",
"vendor": "vraj404",
"versions": [
{
"status": "affected",
"version": "2808d057e7ddc5295519a487365b0cacfd0ba8c4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Wuwj (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This impacts the function move_uploaded_file of the file home.php. The manipulation of the argument my_img leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "Unrestricted Upload",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T14:30:16.739Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422256 | vraj404 Criminal-Management-System home.php move_uploaded_file unrestricted upload",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/422256"
},
{
"name": "VDB-422256 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422256/cti"
},
{
"name": "CVE-2026-112149 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112149"
},
{
"name": "Submit #1014014 | vraj404 Criminal-Management-System 2808d057e7ddc5295519a487365b0cacfd0ba8c4 Unrestricted Upload",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1014014"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/vraj404/Criminal-Management-System/issues/1"
},
{
"tags": [
"product"
],
"url": "https://github.com/vraj404/Criminal-Management-System/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-19T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-19T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-19T07:55:49.000Z",
"value": "VulDB entry last update"
}
],
"title": "vraj404 Criminal-Management-System home.php move_uploaded_file unrestricted upload",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112149",
"datePublished": "2026-10-19T14:30:16.739Z",
"dateReserved": "2026-10-19T05:50:26.730Z",
"dateUpdated": "2026-10-19T16:44:41.590Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}