# CVE-2026-85517: code-projects Vehicle Management System information disclosure via exposed SQL database file

Source: https://junglewise.ai/threats/cve-2026-85517-code-projects-vehicle-management-system-information-disclosure  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-85517 · Severity: medium · CVSS 5.3 · Published 2026-09-04

The Vehicle Management System is a PHP-based application used to manage vehicle-related data and operations. A critical flaw allows remote attackers to access a sensitive SQL database backup file (.sql) that is exposed in the public web directory, potentially revealing database contents including usernames, passwords, and other confidential information without requiring any authentication.

Technologies: [Code-Projects Vehicle Management System](https://junglewise.ai/threats/technologies/vehicle-management-system). Vendors: [Code-Projects](https://junglewise.ai/threats/vendors/code-projects).

## Quick answers

**Is CVE-2026-85517 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85517 being exploited in the wild.

**How severe is CVE-2026-85517?** Medium severity, with a CVSS score of 5.3, published 4 September 2026.

**Which products and versions are affected?** Code-Projects Vehicle Management System 1.0.

**Is there a fix for CVE-2026-85517?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-85517 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-85517?** Check whether you run Code-Projects Vehicle Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an insecure file handling issue (CWE-434 / CWE-538) in which SQL database backup files are left in the web root directory and are directly accessible via HTTP requests. The vulnerable component is the SQL Database Backup File Handler; an attacker can craft a simple GET request to /vehicle_management.sql to retrieve the entire database backup. No authentication is required and the attack vector is network-based. The root cause is improper deployment practices leaving sensitive backup files unprotected. An attacker can download the SQL file to obtain database credentials, user data, and internal system information, potentially leading to further compromise. Mitigation requires removing SQL files from the public web root and implementing proper access controls.

## Affected products

- code-projects Vehicle Management System 1.0

## Timeline

- 2026-09-04: disclosed
- other: Exploit published and available

## References

- [https://code-projects.org/](https://code-projects.org/)
- [https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Vehicle%20Management%20System%20in%20PHP%20%E2%80%93%20Sensitive%20Information%20Disclosure%20via%20Exposed%20Database%20File.md](https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Vehicle%20Management%20System%20in%20PHP%20%E2%80%93%20Sensitive%20Information%20Disclosure%20via%20Exposed%20Database%20File.md)

## Related threats

- [code-projects Vehicle Management System SQL injection in busid parameter](https://junglewise.ai/threats/cve-2026-85516-code-projects-vehicle-management-system-sql-injection-in-busid)
- [code-projects Vehicle Management System unrestricted upload in newdriver.php](https://junglewise.ai/threats/cve-2026-11344-code-projects-vehicle-management-system-unrestricted-upload-in)