CVE-2026-114266
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A security vulnerability has been detected in ProjectWorlds Advanced Library Management System 1.0 in the mysqli_query function of profile.php. Manipulation of the admin_id argument leads to SQL injection. The attack can be carried out remotely, and the exploit has been publicly disclosed.
Risk Assessment
An attacker could remotely execute arbitrary SQL queries, potentially leading to theft, modification, or deletion of database data.
Recommendation
Apply the patch or mitigation as soon as possible since the exploit is public; consider implementing input validation and least privilege for the database account.
Other vulnerabilities in ProjectWorlds Advanced Library Management System
See all- CVE-2026-114265Medium
In ProjectWorlds Advanced Library Management System 1.0, the mysqli_query function in returned_book_search.php (Search Form component) does not protect the datefrom/dateto arguments, allowing SQL injection. The attack can be executed remotely, and a public exploit is available that could be used for attacks.
- CVE-2026-114264Medium
In ProjectWorlds Advanced Library Management System 1.0, manipulating the firstname/middlename/lastname/address/branch/type arguments in edit_member.php leads to SQL injection. The vulnerability is remotely exploitable and a public exploit is available.
- CVE-2025-11426Medium
A security flaw was discovered in projectworlds Advanced Library Management System 1.0 in the file /edit_book.php. Manipulation of the image argument results in unrestricted upload, which could allow remote code execution. The exploit has been released publicly and may be used.
Original NVD description (English source)
A security vulnerability has been detected in ProjectWorlds Advanced Library Management System 1.0. This impacts the function mysqli_query of the file profile.php. The manipulation of the argument admin_id leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS