The vulnerability is an SQL injection error in the Officers/searchOff.php file of the Criminal‑Management‑System. Attackers are able to manipulate the Search argument that is passed directly to the mysqli_query function, allowing execution of arbitrary SQL statements against the database. If successfully exploited, an attacker could read, modify, or delete sensitive criminal records, potentially compromising confidentiality, integrity, and availability of the system.

The flaw affects the Criminal‑Management‑System web application maintained by vraj404. All releases up to commit 2808d057e7ddc5295519a487365b0cacfd0ba8c4 are vulnerable; no specific version numbers are published because the project follows a rolling release model, so any deployed instance without a patch is at risk.

The reported CVSS score of 6.9 indicates a medium severity flaw. The vulnerability is confirmed to accept web‑based input, meaning it can be triggered remotely from outside the application’s network. The public disclosure of the exploit suggests it is actively used in the wild, and the absence of an official patch or warning in the CISA KEV catalog further implies that administrators should treat it as a high‑priority issue while a fix is being applied.