CVE-2026-112149

{
  "etk_id": "ETK-2026-2105",
  "cve_id": "CVE-2026-112149",
  "display_id": "CVE-2026-112149",
  "ghsa_id": "GHSA-6rvc-qx3r-7g96",
  "euvd_id": "EUVD-2026-104385",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unrestricted file upload in vraj404 Criminal-Management-System",
  "summary": "Criminal-Management-System revisions through commit 2808d057e7ddc5295519a487365b0cacfd0ba8c4 are affected by insufficient restrictions on a file-upload path. An unauthenticated remote attacker may be able to submit arbitrary files when the affected upload functionality is reachable.",
  "mitigation": "Restrict or disable public access to the affected upload functionality, including the home.php upload path, until it is corrected. Review uploaded content and deployment permissions, and monitor the upstream project for a patched revision; no fixed release is identified in the evidence.",
  "vendor": "vraj404",
  "product": "Criminal Management System",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "2808d057e7ddc5295519a487365b0cacfd0ba8c4"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Criminal-Management-System",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
  "epss_score": 0.0047,
  "epss_percentile": 0.3968,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 15.77436545,
  "t0_at": "2026-10-19T14:30:16.739000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-19T14:30:16.739000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-19T14:30:16.739000+00:00",
      "url": "https://github.com/advisories/GHSA-6rvc-qx3r-7g96"
    }
  }
}