CVE-2026-114266: ProjectWorlds Advanced Library Management System profile.php mysqli_query sql injection
A security vulnerability has been detected in ProjectWorlds Advanced Library Management System 1.0. This impacts the function mysqliquery of the file profile.php. The manipulation of the argument adminid leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs low-privilege access, as indicated by the PR:L metric. Exploitation can be performed remotely and does not require user interaction.
What is the likely impact of successful exploitation?
Successful SQL injection can affect the confidentiality, integrity, and availability of the application, each rated Low in the supplied vector. The vulnerability has a medium CVSS severity of 6.3.
Is exploitation likely in practice?
A public exploit has been disclosed and may be used. The supplied vector marks exploit maturity as Proof-of-Concept (E:P).
How can I determine whether an installation is affected?
The affected component is profile.php, specifically its handling of the admin_id argument in the mysqli_query function. The provided data identifies ProjectWorlds Advanced Library Management System version 1.0 as affected.