Criminal Management System CVE-2026-112151

Exploitation requires network access to the application's home.php endpoint and the ability to submit the Submission Form; the injectable sinks are the id, name, offName, crime, dob, arrDate, crimeDate, sex, address, folder, and more parameters. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed, so any default internet- or network-reachable instance is exploitable. The primary limiting factor is deployment scope: this is a niche open-source project with no version/patch metadata (rolling release), so risk is confined to the small population actually running it; there are no other special feature or configuration prerequisites named in the description.

This is a genuine but low-priority vulnerability. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation, which sounds alarming, but every impact metric is only Low (VC:L/VI:L/VA:L) with no subsequent-system impact, yielding a modest 5.5 score. The vector includes E:P, meaning exploit maturity is Proof-of-Concept, consistent with the description stating a public exploit exists - this is POC availability, NOT confirmed active exploitation. The CVE is not listed in CISA KEV and no EPSS score was provided in the input, so there is no signal of widespread or automated exploitation. The deciding factor is the target: vraj404 Criminal Management System is an obscure, unmaintained GitHub hobby project with no vendor response, so real-world exposure is minimal. Net assessment: a textbook SQL injection worth patching if you run this specific project, but not an enterprise-wide priority. No conflicting signals of note, though the Low confidentiality rating (VC:L) is arguably conservative for an SQL injection that could allow broader database read access - verify impact against your own deployment.

A remote, unauthenticated attacker submits a crafted value in one of the Submission Form parameters (e.g. id, name, crime, address) to home.php, injecting SQL that the application concatenates directly into a database query. Because a public proof-of-concept exploit is available and no authentication or user interaction is required, an attacker can read or tamper with records in the criminal-records database. Exploitation is low-complexity and performed over the network.