CVE-2026-129181: projectworlds Visitor Management System Login Endpoint user%20page.php mysqli_query sql injection
Published Nov 14, 2026
·Updated
A vulnerability has been found in projectworlds Visitor Management System 1.0. This issue affects the function mysqliquery of the file /img/user%20page.php of the component Login Endpoint. Such manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Affected Software
1 affected component
Projectworlds Visitor Management System=1.0
Event History
Nov 14, 2026
CVE Published
via MITRE·07:15 AM
Data Sourced
via MITRE·07:15 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An unauthenticated remote attacker can exploit it. The affected code is part of the Login Endpoint, and the vulnerable Username argument can be manipulated without stated prerequisites.
2
What input is vulnerable?
The SQL injection is triggered by manipulating the Username argument passed to mysqli_query in /img/user%20page.php.
3
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used by attackers.