CVE-2026-10170

MediumCVSS 6.3

Published: 31/05/2026(UTC)Updated: 22/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

16th percentile - higher than 16% of all known CVEs

Summary

Code-projects Visitor Management System 1.0 has an SQL injection vulnerability in file /vms/php/phone_0.php via the phone argument. The attack can be performed remotely. The exploit has been published and may be used.

Risk Assessment

The risk includes remote database access, potentially leading to data leakage, modification, or deletion.

Recommendation

Immediately update Visitor Management System to the latest version or apply a patch to prevent SQL injection.

Other vulnerabilities in Visitor Management System

CVE-2024-22983High
SQL injection vulnerability in Projectworlds Visitor Management System in PHP v.1.0 allows a remote attacker to escalate privileges via the name parameter in the myform.php endpoint.

Original NVD description (English source)

A flaw has been found in code-projects Visitor Management System 1.0. Affected by this issue is some unknown functionality of the file /vms/php/phone_0.php. This manipulation of the argument phone causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS