CVE-2026-129180

projectworlds Visitor Management System actionpage.php mysqli_query sql injection

View on CVE.org
Published Nov 13, 2026 CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed
Description
A flaw has been found in projectworlds Visitor Management System 1.0. This vulnerability affects the function mysqli_query of the file actionpage.php. This manipulation of the argument purpose causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Description A flaw has been found in projectworlds Visitor Management System 1.0. This vulnerability affects the function mysqli_query of the file actionpage.php. This manipulation of the argument purpose causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.
Title projectworlds Visitor Management System actionpage.php mysqli_query sql injection
First Time appeared Projectworlds
Projectworlds visitor Management System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:projectworlds:visitor_management_system:*:*:*:*:*:*:*:*
Vendors & Products Projectworlds
Projectworlds visitor Management System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Nov 13, 2026, 10:30 PM
Reserved
Nov 13, 2026, 5:28 PM

View source JSON

No data.

No data.

No data.

No data.