# CVE-2026-112151: vraj404 Criminal Management System SQL injection in home.php

Source: https://junglewise.ai/threats/cve-2026-112151-a-weakness-has-been-identified-in-vraj404-criminal-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-19. Updated: 2026-10-19  
License: CC BY 4.0 with a link back

CVE-2026-112151 · Severity: high · CVSS 7.3 · Published 2026-10-19

The Criminal Management System is a web application for recording criminal records. An unauthenticated attacker can inject malicious SQL code through form fields in the record submission page, allowing them to extract sensitive data like passwords, insert false records, or time-delay the database to confirm data extraction. No authentication or validation is performed on submitted data, making this a critical remote threat.

Technologies: [Vraj404 Criminal Management System](https://junglewise.ai/threats/technologies/criminal-management-system). Vendors: [Vraj404](https://junglewise.ai/threats/vendors/vraj404).

## Quick answers

**Is CVE-2026-112151 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112151 being exploited in the wild.

**How severe is CVE-2026-112151?** High severity, with a CVSS score of 7.3, published 19 October 2026.

**Which products and versions are affected?** Vraj404 Criminal Management System up to commit 2808d057e7ddc5295519a487365b0cacfd0ba8c4.

**Is there a fix for CVE-2026-112151?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-112151 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-112151?** Check whether you run Vraj404 Criminal Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

SQL injection vulnerability in home.php where all eleven POST parameters (id, name, offName, crime, dob, arrDate, crimeDate, sex, address, folder, more) are concatenated directly into an INSERT statement without escaping or parameterization. The vulnerability is unauthenticated and remotely exploitable via POST requests; an attacker can close the VALUES clause and inject arbitrary SQL including data extraction via subqueries or time-based blind techniques. No fix has been released; the project adopted a rolling release strategy and has not responded to the early disclosure.

## Affected products

- vraj404 Criminal Management System up to commit 2808d057e7ddc5295519a487365b0cacfd0ba8c4

## Timeline

- 2026-10-05: disclosed: Issue reported on GitHub
- 2026-10-19: advisory: CVE-2026-112151 published

## References

- [https://github.com/vraj404/Criminal-Management-System/issues/3](https://github.com/vraj404/Criminal-Management-System/issues/3)
- [https://vuldb.com/cve/CVE-2026-112151](https://vuldb.com/cve/CVE-2026-112151)

## Related threats

- [vraj404 Criminal-Management-System SQL injection in addOfficer.php](https://junglewise.ai/threats/cve-2026-112153-a-vulnerability-was-detected-in-vraj404-criminal-management)
- [vraj404 Criminal-Management-System SQL injection in searchOff.php](https://junglewise.ai/threats/cve-2026-112152-a-security-vulnerability-has-been-detected-in-vraj404-criminal)
- [vraj404 Criminal-Management-System SQL injection in search.php](https://junglewise.ai/threats/cve-2026-112150-a-security-flaw-has-been-discovered-in-vraj404-criminal)
- [vraj404 Criminal-Management-System unrestricted file upload](https://junglewise.ai/threats/cve-2026-112149-a-vulnerability-was-identified-in-vraj404-criminal-management)