CVE-2026-129180: projectworlds Visitor Management System actionpage.php mysqli_query sql injection

Published Nov 13, 2026

Updated

A flaw has been found in projectworlds Visitor Management System 1.0. This vulnerability affects the function mysqliquery of the file actionpage.php. This manipulation of the argument purpose causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.

Event History

Nov 13, 2026

CVE Published

via MITRE·10:30 PM

Data Sourced

via MITRE·10:30 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attack can be initiated remotely and requires no privileges or user interaction according to the supplied vector. Exploitation targets the purpose argument handled by mysqli_query in actionpage.php.

How urgent is remediation?

The issue is rated medium severity with a 5.5 score, but public exploit availability is reported. Prioritize systems where the vulnerable application is reachable remotely.

How can I determine whether an installation is affected?

The affected product version identified in the data is projectworlds Visitor Management System 1.0. Review whether actionpage.php processes the purpose parameter in the vulnerable mysqli_query path.

CVE-2026-129180: projectworlds Visitor Management System actionpage.php mysqli_query sql injection

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

How urgent is remediation?

How can I determine whether an installation is affected?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

How urgent is remediation?

How can I determine whether an installation is affected?