CVE-2025-11067
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A vulnerability in Projectworlds Visitor Management System 1.0 affects the add visitor page (/myform.php). Manipulation of the Name argument leads to cross-site scripting (XSS). The attack can be performed remotely, and the exploit is publicly available.
Risk Assessment
The risk for the organization is the possibility of remote script execution in the browser, which could lead to data theft or session hijacking.
Recommendation
Update the system to a patched version or apply input filtering (e.g., validation and encoding).
Other vulnerabilities in Visitor Management System
See all- CVE-2026-10170Medium
Code-projects Visitor Management System 1.0 has an SQL injection vulnerability in file /vms/php/phone_0.php via the phone argument. The attack can be performed remotely. The exploit has been published and may be used.
- CVE-2024-22983High
SQL injection vulnerability in Projectworlds Visitor Management System in PHP v.1.0 allows a remote attacker to escalate privileges via the name parameter in the myform.php endpoint.
Original NVD description (English source)
A vulnerability has been found in Projectworlds Visitor Management System 1.0. Affected is an unknown function of the file /myform.php of the component Add Visitor Page. The manipulation of the argument Name leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS