CVE-2026-114264: SQL Injection in ProjectWorlds Advanced Library Management System

This vulnerability affects ProjectWorlds Advanced Library Management System version 1.0. It involves SQL injection via manipulation of certain input parameters in the edit_member.php file. The vulnerability allows an attacker with high privileges (PR:H) to perform remote attacks without user interaction, with low complexity and low impact on confidentiality, integrity, and availability. A public exploit is available, increasing the risk of exploitation. No patch or vendor advisory is provided, so patch status is unknown.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The CVSS vector indicates limited impact on confidentiality, integrity, and availability, but the presence of a public exploit increases the risk of attack.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the affected system and monitor for suspicious activity related to the vulnerable parameters. Consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting edit_member.php.