CVE-2026-114265: ProjectWorlds Advanced Library Management System Search Form returned_book_search.php mysqli_query sql injection
A weakness has been identified in ProjectWorlds Advanced Library Management System 1.0. This affects the function mysqliquery of the file returnedbooksearch.php of the component Search Form. Executing a manipulation of the argument datefrom/dateto can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs network access to the affected application and privileges sufficient to use the Search Form. No user interaction is required.
Which inputs are involved in the injection?
The vulnerable inputs are the datefrom and dateto arguments handled by returned_book_search.php. Manipulating either value can reach a mysqli_query call and lead to SQL injection.
Is public exploit information available?
Yes. The available data states that an exploit has been made public and could be used in attacks.