{"id":"CVE-2021-47846","state":"PUBLISHED","title":"Digital Crime Report Management System 1.0 - SQL Injection","description":"Digital Crime Report Management System 1.0 contains a critical SQL injection vulnerability affecting multiple login pages that allows unauthenticated attackers to bypass authentication. Attackers can exploit the vulnerability by sending crafted SQL injection payloads in email and password parameters across police, incharge, user, and HQ login endpoints.","publishedAt":"2026-01-21T17:27:34.674Z","updatedAt":"2026-04-07T14:06:18.340Z","severity":{"score":8.8,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["I Want Source Codes Digital Crime Report Management System"],"affected":[{"vendor":"I Want Source Codes","product":"Digital Crime Report Management System","versions":[{"version":"1.0","status":"affected"}]}],"references":["https://www.exploit-db.com/exploits/49761","https://iwantsourcecodes.com/digital-crime-report-management-system-in-php-with-source-code/","https://iwantfilemanager.com/?dl=b48d951cbdd50568b031aab3b619fed2","https://www.vulncheck.com/advisories/digital-crime-report-management-system-sql-injection"],"weaknesses":["CWE-89"],"ingestedAt":"2026-10-29T19:49:19.404Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/47xxx/CVE-2021-47846.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2021-47846","state":"PUBLISHED","datePublished":"2026-01-21T17:27:34.674Z","dateUpdated":"2026-04-07T14:06:18.340Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-01-14T17:11:19.902Z"},"containers":{"cna":{"title":"Digital Crime Report Management System 1.0 - SQL Injection","descriptions":[{"lang":"en","value":"Digital Crime Report Management System 1.0 contains a critical SQL injection vulnerability affecting multiple login pages that allows unauthenticated attackers to bypass authentication. Attackers can exploit the vulnerability by sending crafted SQL injection payloads in email and password parameters across police, incharge, user, and HQ login endpoints."}],"affected":[{"vendor":"I Want Source Codes","product":"Digital Crime Report Management System","versions":[{"version":"1.0","status":"affected"}]}],"references":[{"url":"https://www.exploit-db.com/exploits/49761","name":"ExploitDB-49761","tags":["exploit"]},{"url":"https://iwantsourcecodes.com/digital-crime-report-management-system-in-php-with-source-code/","name":"Vendor Homepage","tags":["product"]},{"url":"https://iwantfilemanager.com/?dl=b48d951cbdd50568b031aab3b619fed2","name":"Software Download Link","tags":["product"]},{"url":"https://www.vulncheck.com/advisories/digital-crime-report-management-system-sql-injection","name":"VulnCheck Advisory: Digital Crime Report Management System 1.0 - SQL Injection","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.8,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS"},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","lang":"en","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-04-07T14:06:18.340Z"},"credits":[{"lang":"en","value":"Galuh Muhammad Iman Akbar (GaluhID)","type":"finder"}],"x_generator":{"engine":"vulncheck"},"datePublic":"2021-04-14T00:00:00.000Z"},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-01-22T15:53:24.785119Z","id":"CVE-2021-47846","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-01-22T15:53:32.751Z"}}]}}}