ProjectWorlds ALMS CVE-2026-114265

Exploitation requires an authenticated low-privileged session (CVSS PR:L) with access to the Search Form component's returned-book search; the attacker must be able to reach returned_book_search.php and supply the 'datefrom' or 'dateto' GET/POST parameters, which are concatenated unsanitized into a mysqli_query call. No user interaction or non-default configuration is needed (UI:N), but the mandatory valid account credential is the primary limiting factor that prevents anonymous internet-wide exploitation. Affects ProjectWorlds Advanced Library Management System 1.0.

This is a moderate-to-low real-world priority despite being a code-execution-adjacent SQL injection (CWE-89). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates a network-reachable, low-complexity attack, but PR:L confirms the attacker must already hold a valid low-privileged account, which meaningfully narrows the exploit population versus a fully unauthenticated flaw. The vendor-assigned impact is limited across the board (VC:L/VI:L/VA:L), and the E:P (Proof-of-Concept) exploit maturity aligns with the input signal that a POC exists but there is NO evidence of active exploitation. This CVE is not in CISA KEV and no EPSS score was provided in the input, so exploitation probability cannot be quantified from the data given. All intelligence comes from a single source (VulDB) plus a GitHub POC repository, so corroboration is weak. Net: a genuine but low-severity authenticated SQLi in a niche product - patch when convenient, not an emergency, and the low deployment footprint further reduces aggregate risk. Note a mild tension: the vendor rated confidentiality/integrity/availability all 'Low' even though SQL injection frequently permits full database extraction, so the true confidentiality impact may be understated - verify against the actual query context.

An attacker with a valid low-privileged application account navigates to the returned-book search feature and submits a crafted value in the 'datefrom' or 'dateto' parameter, which is passed unsanitized into a mysqli_query call in returned_book_search.php. Using standard blind or UNION-based SQL injection, they extract credentials and other records from the library database. A public POC for this exact endpoint is available on GitHub, lowering the skill barrier to reproduce the attack.