CVE-2021-47846

8.8 highEPSS 0.4%

High (8.8). EPSS 0.4% chance of exploitation in the next 30 days.

Digital Crime Report Management System 1.0 contains a critical SQL injection vulnerability affecting multiple login pages that allows unauthenticated attackers to bypass authentication. Attackers can exploit the vulnerability by sending crafted SQL injection payloads in email and password parameters across police, incharge, user, and HQ login endpoints.

Severity

CVSS 4.0

8.8 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

8.2 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 37% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2026-01-21
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://iwantfilemanager.com/?dl=b48d951cbdd50568b031aab3b619fed2
https://iwantsourcecodes.com/digital-crime-report-management-system-in-php-with-source-code/
https://www.exploit-db.com/exploits/49761
https://www.vulncheck.com/advisories/digital-crime-report-management-system-sql-injection

Check your stack JSON