CVE-2025-13278
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
A vulnerability has been found in projectworlds Advanced Library Management System 1.0. Impacted is an unknown function of the file /borrowed_book_search.php. Such manipulation of the argument datefrom/dateto leads to SQL injection. The attack can be launched remotely, and the exploit has been disclosed to the public.
Risk Assessment
The risk includes unauthorized access to the database, theft or modification of library data. This can lead to confidentiality and integrity breaches.
Recommendation
Immediately update the system or apply vendor patches. Also use parameterized SQL queries and validate input data.
Other vulnerabilities in Advanced Library Management System
See all- CVE-2025-13256Medium
A weakness has been identified in projectworlds Advanced Library Management System 1.0. Impacted is an unknown function of the file /borrow.php. Executing a manipulation of the argument roll_number can lead to SQL injection. It is possible to launch the attack remotely, and the exploit has been made available to the public.
- CVE-2025-13255Medium
In the Advanced Library Management System 1.0 from projectworlds, a vulnerability was found in the file /book_search.php, where manipulation of the arguments book_pub/book_title results in SQL injection. The attack can be initiated remotely, and the exploit has been publicly released.
- CVE-2025-13254Medium
A SQL injection vulnerability was identified in projectworlds Advanced Library Management System 1.0 in the file /add_member.php via manipulation of the roll_number argument. The attack can be performed remotely and a publicly available exploit may be used.
- CVE-2025-13253Medium
A SQL injection vulnerability was determined in projectworlds Advanced Library Management System 1.0 in the file /add_librarian.php via manipulation of the Username argument. The attack can be carried out remotely and the exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability has been found in projectworlds Advanced Library Management System 1.0. Impacted is an unknown function of the file /borrowed_book_search.php. Such manipulation of the argument datefrom/dateto leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS