CVE-2026-114263

A SQL injection weakness was identified in projectworlds Advanced Library Management System 1.0 in the mysqli_query function of report_search.php. Manipulating the dateto/datefrom arguments allows SQL injection.

A vulnerability has been found in projectworlds Advanced Library Management System 1.0. Impacted is an unknown function of the file /borrowed_book_search.php. Such manipulation of the argument datefrom/dateto leads to SQL injection. The attack can be launched remotely, and the exploit has been disclosed to the public.

A weakness has been identified in projectworlds Advanced Library Management System 1.0. Impacted is an unknown function of the file /borrow.php. Executing a manipulation of the argument roll_number can lead to SQL injection. It is possible to launch the attack remotely, and the exploit has been made available to the public.

In the Advanced Library Management System 1.0 from projectworlds, a vulnerability was found in the file /book_search.php, where manipulation of the arguments book_pub/book_title results in SQL injection. The attack can be initiated remotely, and the exploit has been publicly released.

A SQL injection vulnerability was identified in projectworlds Advanced Library Management System 1.0 in the file /add_member.php via manipulation of the roll_number argument. The attack can be performed remotely and a publicly available exploit may be used.

A SQL injection vulnerability was determined in projectworlds Advanced Library Management System 1.0 in the file /add_librarian.php via manipulation of the Username argument. The attack can be carried out remotely and the exploit has been publicly disclosed.

A cross-site scripting (XSS) vulnerability was discovered in projectworlds Advanced Library Management System 1.0 in an unknown function of /edit_admin.php. Manipulating the firstname argument allows remote attack execution. The exploit is publicly available and may be used.