ProjectWorlds ALMS CVE-2026-114266

Exploitation requires a low-privileged authenticated session on the Advanced Library Management System (CVSS PR:L) and the ability to reach profile.php over the network; the attacker manipulates the admin_id argument, which flows unsanitized into a mysqli_query call. Limiting factors: authentication is required (not a pre-auth flaw), the issue is confirmed only for version 1.0, and no user interaction is needed (UI:N). No special non-default configuration is called out in the description - the injectable code path appears present in the standard application.

This is a textbook low-to-moderate priority issue despite being a remotely reachable SQL injection. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the vendor base score of 5.3 (MEDIUM) agree that the flaw is network-reachable with low complexity but requires at least low-privileged authentication (PR:L), and the impact metrics are uniformly LOW (VC:L/VI:L/VA:L, no scope change). The E:P temporal metric and the referenced GitHub entry confirm proof-of-concept exploit code exists, but this is NOT the same as active exploitation: there is no CISA KEV listing and no EPSS score in the provided data, so widespread automated exploitation cannot be asserted. The reporting source is VulDB, a crowd/automated disclosure feed, and there is no independent vendor advisory. The strongest downward pressure on real-world risk is the affected product itself - ProjectWorlds Advanced Library Management System is an educational/template PHP project with negligible production footprint. Net: a real, publicly-documented authenticated SQLi, but a low operational priority outside of anyone actually running this specific application.

A low-privileged authenticated user of the library portal submits a crafted value in the admin_id parameter to profile.php, which is passed unsanitized into a mysqli_query call, allowing injection of arbitrary SQL. Public proof-of-concept exploit code is referenced (GitHub), lowering the barrier to abuse. Because the CVSS vector is AV:N/AC:L, the request can be sent remotely over the network with low complexity, but an existing authenticated session (PR:L) is required.