CVE-2026-112149: Unrestricted Upload in vraj404 Criminal-Management-System

This vulnerability affects the vraj404 Criminal-Management-System up to commit 2808d057e7ddc5295519a487365b0cacfd0ba8c4. It involves the move_uploaded_file function in home.php where the my_img parameter can be manipulated to perform unrestricted file uploads. This allows remote attackers to upload arbitrary files to the system. The product follows a rolling release approach, so no discrete version numbers are provided for affected or patched releases. The vendor has been informed but has not yet responded or released a patch. Public exploit code exists for this vulnerability.

Successful exploitation allows remote attackers to upload arbitrary files to the server, potentially leading to code execution or system compromise depending on the uploaded content and server configuration. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider implementing temporary mitigations such as restricting file upload types, validating and sanitizing uploaded files, and limiting permissions on upload directories until an official fix is available.