Advanced Library Management System
Monthly
SQL injection in Projectworlds Advanced Library Management System 1.0 allows remote attackers to manipulate database queries via the roll_number parameter in /borrow_book.php. Public exploit code is available, though no active exploitation or vendor patch has been confirmed. The EPSS score indicates a very low probability of widespread exploitation at this time.
SQL injection in Projectworlds Advanced Library Management System 1.0 allows remote attackers to inject malicious SQL via the admin_id parameter in /view_admin.php. This can result in low-impact data disclosure, tampering, or denial of service against the backend database. While a public exploit exists, the vulnerability is not known to be actively exploited in the wild and has a very low EPSS score.
SQL injection in projectworlds Advanced Library Management System 1.0 allows unauthenticated remote attackers to compromise database integrity, confidentiality, and availability via the book_id parameter in /view_book.php. Public proof-of-concept exploit code exists, but the software's niche deployment footprint and low EPSS exploitation probability (0.05%) suggest limited real-world impact; no active exploitation is confirmed by CISA KEV.
SQL injection in projectworlds Advanced Library Management System 1.0 allows remote attackers to inject SQL via the roll_number parameter in /member_search.php. Exploit code is publicly available, but EPSS score is low (0.04%) and no active exploitation has been confirmed by CISA. Attackers may read, modify, or delete database entries depending on database user privileges.
SQL injection in projectworlds Advanced Library Management System 1.0 allows remote attackers to inject malicious SQL via the book_id parameter in /delete_book.php, potentially resulting in unauthorized data access or modification. No authentication is required, and public exploit code is available, as documented by VulDB and NVD.
SQL injection in projectworlds Advanced Library Management System 1.0 allows remote attackers to manipulate the user_id parameter in /delete_member.php, potentially leading to unauthorized database access or data modification. Exploit code is publicly available, but the EPSS exploitation probability is very low (0.04%), and no active exploitation has been confirmed through CISA KEV.
A security flaw has been discovered in projectworlds can pass malicious payloads up to 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in projectworlds Advanced Library Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in projectworlds Advanced Library Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in projectworlds Advanced Library Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in projectworlds Advanced Library Management System 1.0.php. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in projectworlds Advanced Library Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in projectworlds Advanced Library Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in projectworlds Advanced Library Management System 1.0 exposes the application's database through the unsanitized `keywords` parameter on `/index.php`, exploitable by any unauthenticated remote attacker. The CVSS 4.0 score is 5.5 (Medium), with low-level confidentiality, integrity, and availability impact against the vulnerable system and no scope change to subsequent systems. A public proof-of-concept exploit exists (E:P in the provided vector), though EPSS sits at just 0.03% (9th percentile), consistent with the highly niche deployment footprint of this product; no public exploit identified at time of analysis for widespread campaigns.
SQL injection in Advanced Library Management System 1.0 via the user_id parameter in view_member.php allows remote unauthenticated attackers to manipulate database queries, potentially reading, modifying, or deleting data. Exploit code is publicly available, but EPSS indicates very low exploitation likelihood and no active attacks have been reported.
Unrestricted file upload in projectworlds Advanced Library Management System 1.0 allows authenticated remote attackers to upload arbitrary files via the image parameter in /edit_book.php, resulting in low-impact confidentiality, integrity, and availability violations. Public exploit code is available, though EPSS exploitation probability remains very low at 0.05%, suggesting limited real-world attack incentive despite authentication requirement bypass potential.
Stored cross-site scripting in projectworlds Advanced Library Management System 1.0 allows authenticated users with high privileges to inject malicious scripts via the firstname parameter in /edit_admin.php, affecting other users who view admin profiles. Exploitation requires high-privilege authentication and user interaction (UI:P), limiting real-world impact despite network accessibility. Public exploit code exists and EPSS exploitation probability is minimal at 0.03%, suggesting this remains a low-priority vulnerability despite CVE assignment.
SQL injection in Projectworlds Advanced Library Management System 1.0 allows remote attackers to manipulate database queries via the roll_number parameter in /borrow_book.php. Public exploit code is available, though no active exploitation or vendor patch has been confirmed. The EPSS score indicates a very low probability of widespread exploitation at this time.
SQL injection in Projectworlds Advanced Library Management System 1.0 allows remote attackers to inject malicious SQL via the admin_id parameter in /view_admin.php. This can result in low-impact data disclosure, tampering, or denial of service against the backend database. While a public exploit exists, the vulnerability is not known to be actively exploited in the wild and has a very low EPSS score.
SQL injection in projectworlds Advanced Library Management System 1.0 allows unauthenticated remote attackers to compromise database integrity, confidentiality, and availability via the book_id parameter in /view_book.php. Public proof-of-concept exploit code exists, but the software's niche deployment footprint and low EPSS exploitation probability (0.05%) suggest limited real-world impact; no active exploitation is confirmed by CISA KEV.
SQL injection in projectworlds Advanced Library Management System 1.0 allows remote attackers to inject SQL via the roll_number parameter in /member_search.php. Exploit code is publicly available, but EPSS score is low (0.04%) and no active exploitation has been confirmed by CISA. Attackers may read, modify, or delete database entries depending on database user privileges.
SQL injection in projectworlds Advanced Library Management System 1.0 allows remote attackers to inject malicious SQL via the book_id parameter in /delete_book.php, potentially resulting in unauthorized data access or modification. No authentication is required, and public exploit code is available, as documented by VulDB and NVD.
SQL injection in projectworlds Advanced Library Management System 1.0 allows remote attackers to manipulate the user_id parameter in /delete_member.php, potentially leading to unauthorized database access or data modification. Exploit code is publicly available, but the EPSS exploitation probability is very low (0.04%), and no active exploitation has been confirmed through CISA KEV.
A security flaw has been discovered in projectworlds can pass malicious payloads up to 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in projectworlds Advanced Library Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in projectworlds Advanced Library Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in projectworlds Advanced Library Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in projectworlds Advanced Library Management System 1.0.php. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in projectworlds Advanced Library Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in projectworlds Advanced Library Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in projectworlds Advanced Library Management System 1.0 exposes the application's database through the unsanitized `keywords` parameter on `/index.php`, exploitable by any unauthenticated remote attacker. The CVSS 4.0 score is 5.5 (Medium), with low-level confidentiality, integrity, and availability impact against the vulnerable system and no scope change to subsequent systems. A public proof-of-concept exploit exists (E:P in the provided vector), though EPSS sits at just 0.03% (9th percentile), consistent with the highly niche deployment footprint of this product; no public exploit identified at time of analysis for widespread campaigns.
SQL injection in Advanced Library Management System 1.0 via the user_id parameter in view_member.php allows remote unauthenticated attackers to manipulate database queries, potentially reading, modifying, or deleting data. Exploit code is publicly available, but EPSS indicates very low exploitation likelihood and no active attacks have been reported.
Unrestricted file upload in projectworlds Advanced Library Management System 1.0 allows authenticated remote attackers to upload arbitrary files via the image parameter in /edit_book.php, resulting in low-impact confidentiality, integrity, and availability violations. Public exploit code is available, though EPSS exploitation probability remains very low at 0.05%, suggesting limited real-world attack incentive despite authentication requirement bypass potential.
Stored cross-site scripting in projectworlds Advanced Library Management System 1.0 allows authenticated users with high privileges to inject malicious scripts via the firstname parameter in /edit_admin.php, affecting other users who view admin profiles. Exploitation requires high-privilege authentication and user interaction (UI:P), limiting real-world impact despite network accessibility. Public exploit code exists and EPSS exploitation probability is minimal at 0.03%, suggesting this remains a low-priority vulnerability despite CVE assignment.