CVE-2025-11426
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A security flaw was discovered in projectworlds Advanced Library Management System 1.0 in the file /edit_book.php. Manipulation of the image argument results in unrestricted upload, which could allow remote code execution. The exploit has been released publicly and may be used.
Risk Assessment
An attacker could upload malicious files, potentially leading to remote code execution on the server and full system compromise.
Recommendation
It is recommended to update the system or apply patches, and to implement restrictions on uploaded file types and validate them.
Other vulnerabilities in projectworlds Advanced Library Management System
See all- CVE-2026-114266Medium
A security vulnerability has been detected in ProjectWorlds Advanced Library Management System 1.0 in the mysqli_query function of profile.php. Manipulation of the admin_id argument leads to SQL injection. The attack can be carried out remotely, and the exploit has been publicly disclosed.
- CVE-2026-114265Medium
In ProjectWorlds Advanced Library Management System 1.0, the mysqli_query function in returned_book_search.php (Search Form component) does not protect the datefrom/dateto arguments, allowing SQL injection. The attack can be executed remotely, and a public exploit is available that could be used for attacks.
- CVE-2026-114264Medium
In ProjectWorlds Advanced Library Management System 1.0, manipulating the firstname/middlename/lastname/address/branch/type arguments in edit_member.php leads to SQL injection. The vulnerability is remotely exploitable and a public exploit is available.
Original NVD description (English source)
A security flaw has been discovered in projectworlds Advanced Library Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /edit_book.php. The manipulation of the argument image results in unrestricted upload. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS