Visitor Management System vulnerabilities

Code-projects Visitor Management System 1.0 has an SQL injection vulnerability in file /vms/php/phone_0.php via the phone argument. The attack can be performed remotely. The exploit has been published and may be used.

A vulnerability in Projectworlds Visitor Management System 1.0 affects the add visitor page (/myform.php). Manipulation of the Name argument leads to cross-site scripting (XSS). The attack can be performed remotely, and the exploit is publicly available.

SQL injection vulnerability in Projectworlds Visitor Management System in PHP v.1.0 allows a remote attacker to escalate privileges via the name parameter in the myform.php endpoint.