Threat database

A security vulnerability has been detected in ProjectWorlds Advanced Library Management System 1.0. This impacts the function mysqli_query of the file profile.php. The manipulation of the argument admin_id leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.

CVE-2026-114265 is a medium severity SQL injection vulnerability in ProjectWorlds Advanced Library Management System version 1.0. It affects the mysqli_query function in the returned_book_search.php file's Search Form component. The vulnerability arises from improper handling of the datefrom and dateto arguments, allowing remote attackers to execute SQL injection attacks. Exploit code has been publicly disclosed, but no official patch or remediation guidance is currently available.

CVE-2026-114264 is a SQL injection vulnerability in ProjectWorlds Advanced Library Management System version 1.0. The flaw exists in an unspecified function within the edit_member.php file, where manipulation of parameters such as firstname, middlename, lastname, address, branch, or type can lead to SQL injection. Remote exploitation is possible, and a public exploit has been released. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity.

A vulnerability was identified in ProjectWorlds Advanced Library Management System 1.0. The affected element is the function mysqli_query of the file individual_report_search.php. Such manipulation of the argument roll_number leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.

A weakness has been identified in projectworlds Advanced Library Management System 1.0. Impacted is the function mysqli_query of the file report_search.php. Executing a manipulation of the argument dateto/datefrom can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

CVE-2026-86238 is a cross-site scripting (XSS) vulnerability in projectworlds Online Examination System version 1.0. The vulnerability exists in an unknown function within the feedback.php file of the Feedback Form component. It allows remote attackers to manipulate the Name or Subject parameters to execute malicious scripts. The vulnerability has been publicly disclosed, but no official patch or fix information is provided.

A security flaw has been discovered in projectworlds Online Art Gallery Shop Project 1.0. The impacted element is an unknown function of the file /admin/adminHome.ph. The manipulation of the argument social_twitter results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

A vulnerability was identified in projectworlds Online Art Gallery Shop Project 1.0. The affected element is an unknown function of the file /admin/adminHome.php. The manipulation of the argument social_insta leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.

A flaw has been found in projectworlds Online Art Gallery Shop 1.0. Impacted is an unknown function of the file /admin/adminHome.php. Executing a manipulation of the argument social_linked can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.

A flaw has been found in projectworlds hospital-management-system-in-php 1.0. Affected by this vulnerability is the function getAllPatientDetail of the file update_info.php of the component GET Parameter Handler. Executing a manipulation of the argument appointment_no can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-5645 is a medium severity SQL injection vulnerability in projectworlds Car Rental System version 1.0. It affects an unknown functionality in the /pay.php file's Parameter Handler component, specifically via manipulation of the 'mpesa' argument. The vulnerability allows remote attackers to perform SQL injection. Although the exploit code is publicly available, there are no confirmed reports of exploitation in the wild. No official patch or remediation guidance has been provided yet.

CVE-2026-5637 is a medium-severity SQL injection vulnerability in projectworlds Car Rental System version 1.0. The flaw exists in the /message_admin.php file within the Parameter Handler component, where manipulation of the Message argument can lead to SQL injection. This vulnerability can be exploited remotely without authentication. Although the exploit has been publicly disclosed, there are no known exploits in the wild at this time. No official patch or remediation guidance has been provided by the vendor yet.

CVE-2026-5634 is a SQL injection vulnerability in projectworlds Car Rental Project version 1.0. The issue exists in the /book_car.php file within the Parameter Handler component, where the fname argument can be manipulated to perform SQL injection. This vulnerability can be exploited remotely without authentication. The CVSS 4.0 base score is 6.9, indicating a medium severity level. No official patch or remediation guidance is currently available, and there are no known exploits in the wild at this time.

CVE-2026-5368 is a SQL injection vulnerability in projectworlds Car Rental Project version 1.0. It affects an unknown function in the /login.php file's Parameter Handler component, where manipulation of the 'uname' argument allows SQL injection. The vulnerability can be exploited remotely without authentication. The CVSS 4.0 score is 6.9, indicating medium severity. No patch or official remediation information is provided, and no known exploits are currently observed in the wild.

A vulnerability has been found in projectworlds Lawyer Management System 1.0. This impacts an unknown function of the file /lawyer_booking.php. The manipulation of the argument Description leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

CVE-2026-4596 is a medium severity cross-site scripting (XSS) vulnerability found in projectworlds Lawyer Management System version 1.0. The vulnerability arises from improper sanitization of the 'first_Name' parameter in the /lawyers.php file, allowing remote attackers to inject malicious scripts. Exploitation requires no authentication but does require user interaction to trigger the payload. Although no known exploits are currently active in the wild, a public exploit exists. This vulnerability can lead to theft of user credentials, session hijacking, or defacement of the web interface. Organizations using this system should prioritize input validation and output encoding to mitigate risks. The impact is primarily on confidentiality and integrity, with limited availability impact. Countries with significant use of this software or legal sector reliance on such management systems are at higher risk.

A vulnerability was detected in projectworlds Online Notes Sharing System 1.0. This issue affects some unknown processing of the file /login.php of the component Parameters Handler. The manipulation of the argument User results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.

A security vulnerability has been detected in projectworlds Online Art Gallery Shop 1.0. This affects an unknown part of the file /admin/adminHome.php. Such manipulation of the argument reach_nm leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

A weakness has been identified in projectworlds Online Art Gallery Shop 1.0. Affected by this issue is some unknown functionality of the file /admin/adminHome.php. This manipulation of the argument Info causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

A security flaw has been discovered in projectworlds Online Art Gallery Shop 1.0. Affected by this vulnerability is an unknown functionality of the file /?pass=1. The manipulation of the argument fnm results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.