CVE-2026-114264
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
In ProjectWorlds Advanced Library Management System 1.0, manipulating the firstname/middlename/lastname/address/branch/type arguments in edit_member.php leads to SQL injection. The vulnerability is remotely exploitable and a public exploit is available.
Risk Assessment
An attacker can execute arbitrary SQL queries, risking leakage, modification, or deletion of member data and privilege escalation.
Recommendation
Update the application to a patched version or implement parameterized queries and input validation in edit_member.php; restrict network access to the application.
Other vulnerabilities in ProjectWorlds Advanced Library Management System
See all- CVE-2026-114266Medium
A security vulnerability has been detected in ProjectWorlds Advanced Library Management System 1.0 in the mysqli_query function of profile.php. Manipulation of the admin_id argument leads to SQL injection. The attack can be carried out remotely, and the exploit has been publicly disclosed.
- CVE-2026-114265Medium
In ProjectWorlds Advanced Library Management System 1.0, the mysqli_query function in returned_book_search.php (Search Form component) does not protect the datefrom/dateto arguments, allowing SQL injection. The attack can be executed remotely, and a public exploit is available that could be used for attacks.
- CVE-2025-11426Medium
A security flaw was discovered in projectworlds Advanced Library Management System 1.0 in the file /edit_book.php. Manipulation of the image argument results in unrestricted upload, which could allow remote code execution. The exploit has been released publicly and may be used.
Original NVD description (English source)
A security flaw has been discovered in ProjectWorlds Advanced Library Management System 1.0. The impacted element is an unknown function of the file edit_member.php. Performing a manipulation of the argument firstname/middlename/lastname/address/branch/type results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS