Is CVE-2026-85517 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85517 being exploited in the wild.

How severe is CVE-2026-85517?

Medium severity, with a CVSS score of 5.3, published 4 September 2026.

Which products and versions are affected?

Code-Projects Vehicle Management System 1.0.

Is there a fix for CVE-2026-85517?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-85517 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-85517?

Check whether you run Code-Projects Vehicle Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85517: code-projects Vehicle Management System information disclosure via exposed SQL database file

CVE-2026-85517 · Severity: medium · CVSS 5.3 · Published 2026-09-04

The Vehicle Management System is a PHP-based application used to manage vehicle-related data and operations. A critical flaw allows remote attackers to access a sensitive SQL database backup file (.sql) that is exposed in the public web directory, potentially revealing database contents including usernames, passwords, and other confidential information without requiring any authentication.

Technologies: Code-Projects Vehicle Management System. Vendors: Code-Projects.

Quick answers

Is CVE-2026-85517 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85517 being exploited in the wild.
How severe is CVE-2026-85517?: Medium severity, with a CVSS score of 5.3, published 4 September 2026.
Which products and versions are affected?: Code-Projects Vehicle Management System 1.0.
Is there a fix for CVE-2026-85517?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-85517 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-85517?: Check whether you run Code-Projects Vehicle Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an insecure file handling issue (CWE-434 / CWE-538) in which SQL database backup files are left in the web root directory and are directly accessible via HTTP requests. The vulnerable component is the SQL Database Backup File Handler; an attacker can craft a simple GET request to /vehicle_management.sql to retrieve the entire database backup. No authentication is required and the attack vector is network-based. The root cause is improper deployment practices leaving sensitive backup files unprotected. An attacker can download the SQL file to obtain database credentials, user data, and internal system information, potentially leading to further compromise. Mitigation requires removing SQL files from the public web root and implementing proper access controls.

Affected products

code-projects Vehicle Management System 1.0

Timeline

2026-09-04: disclosed
other: Exploit published and available

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.