CVE-2024-22983
HighCVSS 8.1Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
SQL injection vulnerability in Projectworlds Visitor Management System in PHP v.1.0 allows a remote attacker to escalate privileges via the name parameter in the myform.php endpoint.
Risk Assessment
An attacker can exploit this vulnerability to gain unauthorized access to the database, steal data, or take control of the system, posing a serious threat to data confidentiality and integrity.
Recommendation
Immediately update the system to the latest version or apply a security patch, and implement input validation and parameterized SQL queries.
Other vulnerabilities in Visitor Management System
See all- CVE-2026-10170Medium
Code-projects Visitor Management System 1.0 has an SQL injection vulnerability in file /vms/php/phone_0.php via the phone argument. The attack can be performed remotely. The exploit has been published and may be used.
- CVE-2025-11067Low
A vulnerability in Projectworlds Visitor Management System 1.0 affects the add visitor page (/myform.php). Manipulation of the Name argument leads to cross-site scripting (XSS). The attack can be performed remotely, and the exploit is publicly available.
Original NVD description (English source)
SQL injection vulnerability in Projectworlds Visitor Management System in PHP v.1.0 allows a remote attacker to escalate privileges via the name parameter in the myform.php endpoint.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS