Is CVE-2026-112152 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112152 being exploited in the wild.

How severe is CVE-2026-112152?

High severity, with a CVSS score of 7.3, published 19 October 2026.

Which products and versions are affected?

Vraj404 Criminal Management System up to commit 2808d057e7ddc5295519a487365b0cacfd0ba8c4.

How is CVE-2026-112152 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-112152?

Check whether you run Vraj404 Criminal Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112152: vraj404 Criminal-Management-System SQL injection in searchOff.php

CVE-2026-112152 · Severity: high · CVSS 7.3 · Published 2026-10-19

Criminal-Management-System is a web-based police management application that stores criminal and officer records in a database. An unauthenticated attacker can inject malicious SQL through the officer search page to extract the entire database, including credentials, criminal records, and officer information. The vulnerability allows complete compromise of the confidentiality of all stored personal data without requiring authentication or user interaction.

Technologies: Vraj404 Criminal Management System. Vendors: Vraj404.

Quick answers

Is CVE-2026-112152 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112152 being exploited in the wild.
How severe is CVE-2026-112152?: High severity, with a CVSS score of 7.3, published 19 October 2026.
Which products and versions are affected?: Vraj404 Criminal Management System up to commit 2808d057e7ddc5295519a487365b0cacfd0ba8c4.
Is there a fix for CVE-2026-112152?: No fixed version is recorded yet. Use prepared statements with parameterized queries (mysqli_prepare/bind_param) instead of concatenating user input into SQL strings. Add authentication checks before processing the search request to ensure only authorized users can access the search functionality.</anigation> </invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-112152 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-112152?: Check whether you run Vraj404 Criminal Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Use prepared statements with parameterized queries (mysqli_prepare/bind_param) instead of concatenating user input into SQL strings. Add authentication checks before processing the search request to ensure only authorized users can access the search functionality.</anigation> </invoke>

Technical details

A SQL injection vulnerability exists in Officers/searchOff.php where user-supplied search input is concatenated directly into SQL queries without sanitization or prepared statements. The vulnerable mysqli_query call has no authentication check, allowing unauthenticated remote attackers to execute arbitrary SQL via POST parameters. Query results are returned in the response, making information disclosure directly observable; the same unsanitized pattern is also used in a DELETE statement, indicating potential for data modification.

Affected products

vraj404 Criminal-Management-System up to commit 2808d057e7ddc5295519a487365b0cacfd0ba8c4

Timeline

2026-10-05: disclosed: Issue reported on GitHub
2026-10-19: advisory: CVE-2026-112152 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.