CVE-2026-10170
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Code-projects Visitor Management System 1.0 has an SQL injection vulnerability in file /vms/php/phone_0.php via the phone argument. The attack can be performed remotely. The exploit has been published and may be used.
Risk Assessment
The risk includes remote database access, potentially leading to data leakage, modification, or deletion.
Recommendation
Immediately update Visitor Management System to the latest version or apply a patch to prevent SQL injection.
Other vulnerabilities in Visitor Management System
See all- CVE-2025-11067Low
A vulnerability in Projectworlds Visitor Management System 1.0 affects the add visitor page (/myform.php). Manipulation of the Name argument leads to cross-site scripting (XSS). The attack can be performed remotely, and the exploit is publicly available.
- CVE-2024-22983High
SQL injection vulnerability in Projectworlds Visitor Management System in PHP v.1.0 allows a remote attacker to escalate privileges via the name parameter in the myform.php endpoint.
Original NVD description (English source)
A flaw has been found in code-projects Visitor Management System 1.0. Affected by this issue is some unknown functionality of the file /vms/php/phone_0.php. This manipulation of the argument phone causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS