CVE-2026-85516: SQL Injection in code-projects Vehicle Management System

The vulnerability CVE-2026-85516 affects code-projects Vehicle Management System version 1.0. It is caused by improper sanitization of the busid parameter in an unknown function in /busprofile.php, enabling remote attackers to inject SQL commands. This can lead to unauthorized database queries or modifications. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts. Public exploit code exists, increasing the risk of exploitation.

Successful exploitation allows remote attackers to perform SQL injection attacks, potentially leading to unauthorized access or modification of the backend database. The impact is limited to partial confidentiality, integrity, and availability loss as indicated by the CVSS vector. No evidence of active exploitation in the wild is currently known.

No official patch or vendor advisory is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, it is recommended to implement input validation or web application firewall rules to block malicious payloads targeting the busid parameter in /busprofile.php.