CVE-2026-114263: ProjectWorlds Advanced Library Management System individual_report_search.php mysqli_query sql injection
A vulnerability was identified in ProjectWorlds Advanced Library Management System 1.0. The affected element is the function mysqliquery of the file individualreportsearch.php. Such manipulation of the argument rollnumber leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.
Affected Software
Event History
Frequently Asked Questions
What input is vulnerable?
The roll_number argument handled by individual_report_search.php reaches mysqli_query in a way that permits SQL injection.
Can this be exploited remotely without authentication?
Yes. The supplied vector indicates network-based exploitation with no privileges or user interaction required.
Which deployments are known to be affected?
ProjectWorlds Advanced Library Management System version 1.0 is identified as affected. The provided data does not establish whether other versions are vulnerable.
How urgent is remediation?
The issue is rated high with a 7.3 severity score and has a publicly available exploit, so exposed instances should be prioritized for remediation or access restriction.