Advanced Library Management System
Monthly
SQL injection in ProjectWorlds Advanced Library Management System 1.0 allows a low-privileged authenticated remote attacker to manipulate the admin_id argument in profile.php and alter backend mysqli_query statements, with limited confidentiality, integrity, and availability impact per the assessed CVSS 3.1 vector. Publicly available exploit code exists and the issue is remotely reachable, but authentication is required and no CISA KEV active-exploitation confirmation is present.
Authenticated SQL injection in ProjectWorlds Advanced Library Management System 1.0 lets a low-privileged user who can reach the returned-book search form inject SQL through the datefrom or dateto parameters and read sensitive database contents. The flaw is a CWE-89 mysqli_query concatenation issue in returned_book_search.php; exploitation requires a valid account (CVSS PR:L) but no user interaction. Publicly available exploit code exists, and while no CISA KEV entry confirms active exploitation, this is a moderate-to-low real-world priority because the authentication prerequisite limits anonymous internet-wide attacks.
SQL injection in ProjectWorlds Advanced Library Management System 1.0 allows authenticated administrators to inject SQL through the firstname, middlename, lastname, address, branch, or type parameters in edit_member.php. The medium-severity flaw (CVSS 4.0 base 5.1; assessed CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) primarily threatens library member data confidentiality and integrity, with limited availability impact, and requires a high-privilege session to exploit. Publicly available exploit code exists, though no CISA KEV entry confirms active exploitation at time of analysis.
Unauthenticated SQL injection in ProjectWorlds Advanced Library Management System 1.0 lets remote attackers manipulate the roll_number parameter of individual_report_search.php, which is passed unsanitized into a mysqli_query call, enabling arbitrary SQL execution against the backend database. No privileges or user interaction are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L); the practical barrier is exposure, since this is a niche PHP student/hobby application rarely internet-facing. Publicly available exploit code exists and the vector carries E:P, but there is no CISA KEV confirmation of active exploitation; impact is assessed as limited-tier confidentiality, integrity, and availability loss.
SQL injection in Projectworlds Advanced Library Management System 1.0 allows an authenticated low-privilege user to manipulate the dateto and datefrom parameters in report_search.php and potentially read or modify limited database data. Publicly available exploit code exists, but the product is a demonstration/academic PHP application with an extremely narrow deployment footprint, so overall risk is low.
SQL injection in Projectworlds Advanced Library Management System 1.0 allows remote attackers to manipulate database queries via the roll_number parameter in /borrow_book.php. Public exploit code is available, though no active exploitation or vendor patch has been confirmed. The EPSS score indicates a very low probability of widespread exploitation at this time.
SQL injection in Projectworlds Advanced Library Management System 1.0 allows remote attackers to inject malicious SQL via the admin_id parameter in /view_admin.php. This can result in low-impact data disclosure, tampering, or denial of service against the backend database. While a public exploit exists, the vulnerability is not known to be actively exploited in the wild and has a very low EPSS score.
SQL injection in projectworlds Advanced Library Management System 1.0 allows unauthenticated remote attackers to compromise database integrity, confidentiality, and availability via the book_id parameter in /view_book.php. Public proof-of-concept exploit code exists, but the software's niche deployment footprint and low EPSS exploitation probability (0.05%) suggest limited real-world impact; no active exploitation is confirmed by CISA KEV.
SQL injection in projectworlds Advanced Library Management System 1.0 allows remote attackers to inject SQL via the roll_number parameter in /member_search.php. Exploit code is publicly available, but EPSS score is low (0.04%) and no active exploitation has been confirmed by CISA. Attackers may read, modify, or delete database entries depending on database user privileges.
SQL injection in projectworlds Advanced Library Management System 1.0 allows remote attackers to inject malicious SQL via the book_id parameter in /delete_book.php, potentially resulting in unauthorized data access or modification. No authentication is required, and public exploit code is available, as documented by VulDB and NVD.
SQL injection in projectworlds Advanced Library Management System 1.0 allows remote attackers to manipulate the user_id parameter in /delete_member.php, potentially leading to unauthorized database access or data modification. Exploit code is publicly available, but the EPSS exploitation probability is very low (0.04%), and no active exploitation has been confirmed through CISA KEV.
A security flaw has been discovered in projectworlds can pass malicious payloads up to 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in projectworlds Advanced Library Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in projectworlds Advanced Library Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in projectworlds Advanced Library Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in projectworlds Advanced Library Management System 1.0.php. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in projectworlds Advanced Library Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in projectworlds Advanced Library Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in projectworlds Advanced Library Management System 1.0 exposes the application's database through the unsanitized `keywords` parameter on `/index.php`, exploitable by any unauthenticated remote attacker. The CVSS 4.0 score is 5.5 (Medium), with low-level confidentiality, integrity, and availability impact against the vulnerable system and no scope change to subsequent systems. A public proof-of-concept exploit exists (E:P in the provided vector), though EPSS sits at just 0.03% (9th percentile), consistent with the highly niche deployment footprint of this product; no public exploit identified at time of analysis for widespread campaigns.
SQL injection in Advanced Library Management System 1.0 via the user_id parameter in view_member.php allows remote unauthenticated attackers to manipulate database queries, potentially reading, modifying, or deleting data. Exploit code is publicly available, but EPSS indicates very low exploitation likelihood and no active attacks have been reported.
Unrestricted file upload in projectworlds Advanced Library Management System 1.0 allows authenticated remote attackers to upload arbitrary files via the image parameter in /edit_book.php, resulting in low-impact confidentiality, integrity, and availability violations. Public exploit code is available, though EPSS exploitation probability remains very low at 0.05%, suggesting limited real-world attack incentive despite authentication requirement bypass potential.
Stored cross-site scripting in projectworlds Advanced Library Management System 1.0 allows authenticated users with high privileges to inject malicious scripts via the firstname parameter in /edit_admin.php, affecting other users who view admin profiles. Exploitation requires high-privilege authentication and user interaction (UI:P), limiting real-world impact despite network accessibility. Public exploit code exists and EPSS exploitation probability is minimal at 0.03%, suggesting this remains a low-priority vulnerability despite CVE assignment.
SQL injection in ProjectWorlds Advanced Library Management System 1.0 allows a low-privileged authenticated remote attacker to manipulate the admin_id argument in profile.php and alter backend mysqli_query statements, with limited confidentiality, integrity, and availability impact per the assessed CVSS 3.1 vector. Publicly available exploit code exists and the issue is remotely reachable, but authentication is required and no CISA KEV active-exploitation confirmation is present.
Authenticated SQL injection in ProjectWorlds Advanced Library Management System 1.0 lets a low-privileged user who can reach the returned-book search form inject SQL through the datefrom or dateto parameters and read sensitive database contents. The flaw is a CWE-89 mysqli_query concatenation issue in returned_book_search.php; exploitation requires a valid account (CVSS PR:L) but no user interaction. Publicly available exploit code exists, and while no CISA KEV entry confirms active exploitation, this is a moderate-to-low real-world priority because the authentication prerequisite limits anonymous internet-wide attacks.
SQL injection in ProjectWorlds Advanced Library Management System 1.0 allows authenticated administrators to inject SQL through the firstname, middlename, lastname, address, branch, or type parameters in edit_member.php. The medium-severity flaw (CVSS 4.0 base 5.1; assessed CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) primarily threatens library member data confidentiality and integrity, with limited availability impact, and requires a high-privilege session to exploit. Publicly available exploit code exists, though no CISA KEV entry confirms active exploitation at time of analysis.
Unauthenticated SQL injection in ProjectWorlds Advanced Library Management System 1.0 lets remote attackers manipulate the roll_number parameter of individual_report_search.php, which is passed unsanitized into a mysqli_query call, enabling arbitrary SQL execution against the backend database. No privileges or user interaction are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L); the practical barrier is exposure, since this is a niche PHP student/hobby application rarely internet-facing. Publicly available exploit code exists and the vector carries E:P, but there is no CISA KEV confirmation of active exploitation; impact is assessed as limited-tier confidentiality, integrity, and availability loss.
SQL injection in Projectworlds Advanced Library Management System 1.0 allows an authenticated low-privilege user to manipulate the dateto and datefrom parameters in report_search.php and potentially read or modify limited database data. Publicly available exploit code exists, but the product is a demonstration/academic PHP application with an extremely narrow deployment footprint, so overall risk is low.
SQL injection in Projectworlds Advanced Library Management System 1.0 allows remote attackers to manipulate database queries via the roll_number parameter in /borrow_book.php. Public exploit code is available, though no active exploitation or vendor patch has been confirmed. The EPSS score indicates a very low probability of widespread exploitation at this time.
SQL injection in Projectworlds Advanced Library Management System 1.0 allows remote attackers to inject malicious SQL via the admin_id parameter in /view_admin.php. This can result in low-impact data disclosure, tampering, or denial of service against the backend database. While a public exploit exists, the vulnerability is not known to be actively exploited in the wild and has a very low EPSS score.
SQL injection in projectworlds Advanced Library Management System 1.0 allows unauthenticated remote attackers to compromise database integrity, confidentiality, and availability via the book_id parameter in /view_book.php. Public proof-of-concept exploit code exists, but the software's niche deployment footprint and low EPSS exploitation probability (0.05%) suggest limited real-world impact; no active exploitation is confirmed by CISA KEV.
SQL injection in projectworlds Advanced Library Management System 1.0 allows remote attackers to inject SQL via the roll_number parameter in /member_search.php. Exploit code is publicly available, but EPSS score is low (0.04%) and no active exploitation has been confirmed by CISA. Attackers may read, modify, or delete database entries depending on database user privileges.
SQL injection in projectworlds Advanced Library Management System 1.0 allows remote attackers to inject malicious SQL via the book_id parameter in /delete_book.php, potentially resulting in unauthorized data access or modification. No authentication is required, and public exploit code is available, as documented by VulDB and NVD.
SQL injection in projectworlds Advanced Library Management System 1.0 allows remote attackers to manipulate the user_id parameter in /delete_member.php, potentially leading to unauthorized database access or data modification. Exploit code is publicly available, but the EPSS exploitation probability is very low (0.04%), and no active exploitation has been confirmed through CISA KEV.
A security flaw has been discovered in projectworlds can pass malicious payloads up to 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in projectworlds Advanced Library Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in projectworlds Advanced Library Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in projectworlds Advanced Library Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in projectworlds Advanced Library Management System 1.0.php. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in projectworlds Advanced Library Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in projectworlds Advanced Library Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in projectworlds Advanced Library Management System 1.0 exposes the application's database through the unsanitized `keywords` parameter on `/index.php`, exploitable by any unauthenticated remote attacker. The CVSS 4.0 score is 5.5 (Medium), with low-level confidentiality, integrity, and availability impact against the vulnerable system and no scope change to subsequent systems. A public proof-of-concept exploit exists (E:P in the provided vector), though EPSS sits at just 0.03% (9th percentile), consistent with the highly niche deployment footprint of this product; no public exploit identified at time of analysis for widespread campaigns.
SQL injection in Advanced Library Management System 1.0 via the user_id parameter in view_member.php allows remote unauthenticated attackers to manipulate database queries, potentially reading, modifying, or deleting data. Exploit code is publicly available, but EPSS indicates very low exploitation likelihood and no active attacks have been reported.
Unrestricted file upload in projectworlds Advanced Library Management System 1.0 allows authenticated remote attackers to upload arbitrary files via the image parameter in /edit_book.php, resulting in low-impact confidentiality, integrity, and availability violations. Public exploit code is available, though EPSS exploitation probability remains very low at 0.05%, suggesting limited real-world attack incentive despite authentication requirement bypass potential.
Stored cross-site scripting in projectworlds Advanced Library Management System 1.0 allows authenticated users with high privileges to inject malicious scripts via the firstname parameter in /edit_admin.php, affecting other users who view admin profiles. Exploitation requires high-privilege authentication and user interaction (UI:P), limiting real-world impact despite network accessibility. Public exploit code exists and EPSS exploitation probability is minimal at 0.03%, suggesting this remains a low-priority vulnerability despite CVE assignment.