Vulnerability · Published Oct 19, 2026 · Assigned by VulDB

CVE-2026-112149vraj404 Criminal-Management-System home.php move_uploaded_file unrestricted upload

High 7.3

In plain English

A high-severity unrestricted file upload in Criminal-Management-System from vraj404. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.3%top 78.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was identified in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This impacts the function move_uploaded_file of the file home.php. The manipulation of the argument my_img leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

Affected products (as reported)

Vendor	Product	Versions
vraj404	Criminal-Management-System	2808d057e7ddc5295519a487365b0cacfd0ba8c4

Weakness: CWE-434, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

References

VDB-422256 | vraj404 Criminal-Management-System home.php move_uploaded_file unrestricted upload vdb-entry, technical-description
VDB-422256 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-112149 | CVE Analysis and Report third-party-advisory
Submit #1014014 | vraj404 Criminal-Management-System 2808d057e7ddc5295519a487365b0cacfd0ba8c4 Unrestricted Upload third-party-advisory
https://github.com/vraj404/Criminal-Management-System/issues/1 exploit, issue-tracking
https://github.com/vraj404/Criminal-Management-System/ product