EUVD-2026-19364
GHSA-jhff-3rr5-hh56
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Secure storage of sensitive data
|
| Impact | Although the CVSS 5.5 score is moderate, multiple risk signals elevate practical priority. The CVSS vector confirms unauthenticated remote network access (AV:N, PR:N, AC:L), meaning any Internet-connected instance is immediately exploitable without credentials. The E:P (Exploit: Proof of Concept) flag and publicly available exploit code on GitHub substantially increase real-world exploitation likelihood. The attack vector is trivial-direct file access over HTTP-with no user interaction required (UI:N). The confidentiality impact is rated 'Low' (VC:L) in the CVSS 4.0 vector, but this underestimates the value of FIR database dumps, which contain sensitive police complaints, personal information, and investigation data. For systems in production without network segmentation, this presents a practical 'Medium' to 'High' priority despite the moderate score, particularly if the system is internet-facing or accessible from untrusted networks. The absence of integrity or availability impact (VI:N, VA:N) means this is an information disclosure risk only, not a code execution or service disruption vector. |
| Exploit ScenarioDerived | An attacker scans the Code-Projects Online FIR System deployment and discovers the publicly accessible /complaints.sql file via directory enumeration or web crawler. Using the publicly available exploit code from GitHub (https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Sensitive%20Information%20Disclosure%20in%20Online%20FIR%20System%20PHP%20Exposed%20Database%20Backup.md), the attacker downloads the unprotected SQL backup file without authentication, extracting database credentials, user accounts, and potentially thousands of FIR complaints containing personal information, investigation details, and sensitive police operations data for further exploitation or sale. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 06, 2026
Code-Projects Online FIR System 1.0 stores sensitive database backup files insecurely, allowing unauthenticated remote attackers to access the /complaints.sql backup file and disclose confidential information. The CVSS 5.5 score reflects low confidentiality impact but network-accessible exposure; publicly available exploit code exists, elevating practical risk despite the moderate score.
RemediationAI
Immediately move or delete the /complaints.sql backup file from the web-accessible directory and restrict database backup file storage to non-web-accessible locations with appropriate filesystem permissions. Apply any security patches released by Code-Projects (check https://code-projects.org/ for patch availability and version updates). As an interim measure, implement authentication controls or IP-based access restrictions on database backup files using web server configuration (.htaccess for Apache, nginx location blocks, etc.), and ensure backup files are encrypted at rest and never stored in the web root. If using Online FIR System 1.0, strongly consider upgrading to a newer version once available, and conduct a forensic audit of access logs to determine if the /complaints.sql file was previously accessed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Online FIR System (First Information Report management software) fails to properly protect SQL database backup files, specifically /complaints.sql. This falls under CWE-922 (Insecure Storage of Sensitive Information), a weakness in data protection controls. The SQL backup file is accessible via the HTTP/HTTPS network interface without authentication (PR:N per CVSS vector), allowing attackers to retrieve unencrypted or inadequately protected database dumps. The affected product is identified by CPE cpe:2.3:a:code-projects:online_fir_system:*:*:*:*:*:*:*:*, indicating all versions of this product line are potentially vulnerable. Database backup files typically contain plaintext database credentials, user accounts, hashed or plaintext passwords, and operational data-precisely the information an FIR (police complaint) system would contain.
Know when Online Fir System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was detected in code-projects Online FIR System 1.0. Affected by this issue is some unknown functionality of the file /complaints.sql of the component SQL Database Backup File Handler. The manipulation results in insecure storage of sensitive information. The attack may be performed from remote. The exploit is now public and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Online Fir System
View allSQL injection in code-projects Online FIR System 1.0 allows unauthenticated remote attackers to extract, modify, or dele
A vulnerability was found in code-projects Online FIR System 1.0. Rated low severity (CVSS 3.5), this vulnerability is r
Exploit-DB