CVE-2024-22983

HighCVSS 8.1

Published: 28/02/2024(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.81%

52th percentile - higher than 52% of all known CVEs

Summary

SQL injection vulnerability in Projectworlds Visitor Management System in PHP v.1.0 allows a remote attacker to escalate privileges via the name parameter in the myform.php endpoint.

Risk Assessment

An attacker can exploit this vulnerability to gain unauthorized access to the database, steal data, or take control of the system, posing a serious threat to data confidentiality and integrity.

Recommendation

Immediately update the system to the latest version or apply a security patch, and implement input validation and parameterized SQL queries.

Other vulnerabilities in Visitor Management System

CVE-2026-10170Medium
Code-projects Visitor Management System 1.0 has an SQL injection vulnerability in file /vms/php/phone_0.php via the phone argument. The attack can be performed remotely. The exploit has been published and may be used.

Original NVD description (English source)

SQL injection vulnerability in Projectworlds Visitor Management System in PHP v.1.0 allows a remote attacker to escalate privileges via the name parameter in the myform.php endpoint.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS