CVE-2026-9364: projectworlds Online Art Gallery Shop adminHome.php sql injection

Published May 24, 2026

Updated

A flaw has been found in projectworlds Online Art Gallery Shop 1.0. Impacted is an unknown function of the file /admin/adminHome.php. Executing a manipulation of the argument sociallinked can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.

Affected Software

1 affected component

Projectworlds Online Art Gallery Shop=1.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Remove
Remove projectworlds Online Art Gallery Shop /admin/adminHome.php from your environment.
If the admin interface or this file is not required, disable or remove /admin/adminHome.php (or disable the admin area) to eliminate the vulnerable endpoint until a code fix is implemented.
Configuration
Sanitize and validate the 'social_linked' parameter and update database access code in /admin/adminHome.php to use parameterized queries or prepared statements to eliminate SQL injection.
projectworlds Online Art Gallery Shop (/admin/adminHome.php) social_linked input handling = validate and use parameterized queries / prepared statements
Compensating control
Restrict remote access to the /admin/ area (including /admin/adminHome.php) to trusted IP addresses via firewall, VPN, or HTTP authentication; block or rate-limit requests targeting the 'social_linked' parameter at the web application firewall if available.
Operational
Search web and application logs for requests to /admin/adminHome.php and for uses of the 'social_linked' parameter, investigate any suspicious activity or indicators of compromise, and remediate any affected systems.

Event History

May 24, 2026

CVE Published

via MITRE·07:30 AM

Data Sourced

via MITRE·07:30 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:16 AM

DescriptionSeverityWeakness

Apr 28, 58520

Event

via FIRST·12:58 PM

Frequently Asked Questions

What is the severity of CVE-2026-9364?

The severity of CVE-2026-9364 is rated high with a score of 7.3.

How do I fix CVE-2026-9364?

To fix CVE-2026-9364, you should sanitize and validate all input parameters, particularly the 'social_linked' argument, to prevent SQL injection.

What type of vulnerability is CVE-2026-9364?

CVE-2026-9364 is classified as an SQL injection vulnerability.

Can CVE-2026-9364 be exploited remotely?

Yes, CVE-2026-9364 can be exploited remotely due to its nature of SQL injection.

What software is affected by CVE-2026-9364?

CVE-2026-9364 affects Projectworlds Online Art Gallery Shop version 1.0.