CVE-2026-56034
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
An unauthenticated SQL Injection vulnerability exists in Library Management System versions 3.5.7 and earlier. An attacker can remotely execute arbitrary SQL queries, leading to unauthorized database access.
Risk Assessment
The risk includes theft, modification, or deletion of library data, including user and book records. It may also allow system takeover through privilege escalation.
Recommendation
Immediately upgrade the system to a version newer than 3.5.7 that contains the fix. In the meantime, restrict access to the system to trusted networks only.
Other vulnerabilities in Library Management System
See all- CVE-2026-18666Medium
The Library Management System WordPress plugin before version 3.6.7 does not sanitize and escape a user-supplied parameter before using it in a SQL statement. This allows users with a role as low as Subscriber to perform SQL injection and extract arbitrary data from the database, including user password hashes.
- CVE-2026-12582High
The Library Management System WordPress plugin before version 3.5.8 does not sanitize or escape a user-supplied parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection and extract arbitrary data from the database, including user password hashes.
- CVE-2025-9755Medium
A vulnerability was discovered in Khanakag-17 Library Management System up to 60ed174506094dcd166e34904a54288e5d10ff24 involving cross-site scripting in the file /index.php. Manipulation of the msg argument allows remote attack execution. The exploit is publicly available and may be used.
Original NVD description (English source)
Unauthenticated SQL Injection in Library Management System <= 3.5.7 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS