Is CVE-2026-112153 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112153 being exploited in the wild.

How severe is CVE-2026-112153?

High severity, with a CVSS score of 7.3, published 19 October 2026.

Which products and versions are affected?

Vraj404 Criminal Management System up to commit 2808d057e7ddc5295519a487365b0cacfd0ba8c4.

Is there a fix for CVE-2026-112153?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-112153 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-112153?

Check whether you run Vraj404 Criminal Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112153: vraj404 Criminal-Management-System SQL injection in addOfficer.php

CVE-2026-112153 · Severity: high · CVSS 7.3 · Published 2026-10-19

A criminal record management system is vulnerable to unauthenticated SQL injection through its officer registration form. An attacker can extract the entire database—including officer records, criminal data, and user credentials—without authentication. The application also reflects user input without encoding, allowing attackers to inject arbitrary data into the database or craft malicious pages.

Technologies: Vraj404 Criminal Management System. Vendors: Vraj404.

Quick answers

Is CVE-2026-112153 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112153 being exploited in the wild.
How severe is CVE-2026-112153?: High severity, with a CVSS score of 7.3, published 19 October 2026.
Which products and versions are affected?: Vraj404 Criminal Management System up to commit 2808d057e7ddc5295519a487365b0cacfd0ba8c4.
Is there a fix for CVE-2026-112153?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-112153 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-112153?: Check whether you run Vraj404 Criminal Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Officers/addOfficer.php component concatenates POST parameters (offName, offID, ID, contact, gender, weapon, role) directly into an SQL INSERT query without escaping or prepared statements, and echoes the raw mysqli_error to the client. This enables error-based SQL injection accessible remotely without authentication; an attacker can use functions like extractvalue() to extract database contents via visible error messages. The application also echoes the offName parameter unencoded into the HTML response, creating a reflected XSS sink.

Affected products

vraj404 Criminal-Management-System up to commit 2808d057e7ddc5295519a487365b0cacfd0ba8c4

Timeline

2026-10-19: disclosed
2026-10-19: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.