CVE-2026-114265
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
In ProjectWorlds Advanced Library Management System 1.0, the mysqli_query function in returned_book_search.php (Search Form component) does not protect the datefrom/dateto arguments, allowing SQL injection. The attack can be executed remotely, and a public exploit is available that could be used for attacks.
Risk Assessment
Potential unauthorized reading or modification of application database data, and depending on database privileges, further escalation. Risk applies to network-accessible deployments of this system.
Recommendation
Parameterize queries and validate the datefrom/dateto arguments in returned_book_search.php. Until fixed, restrict access to the application or disable the vulnerable form.
Other vulnerabilities in ProjectWorlds Advanced Library Management System
See all- CVE-2026-114266Medium
A security vulnerability has been detected in ProjectWorlds Advanced Library Management System 1.0 in the mysqli_query function of profile.php. Manipulation of the admin_id argument leads to SQL injection. The attack can be carried out remotely, and the exploit has been publicly disclosed.
- CVE-2026-114264Medium
In ProjectWorlds Advanced Library Management System 1.0, manipulating the firstname/middlename/lastname/address/branch/type arguments in edit_member.php leads to SQL injection. The vulnerability is remotely exploitable and a public exploit is available.
- CVE-2025-11426Medium
A security flaw was discovered in projectworlds Advanced Library Management System 1.0 in the file /edit_book.php. Manipulation of the image argument results in unrestricted upload, which could allow remote code execution. The exploit has been released publicly and may be used.
Original NVD description (English source)
A weakness has been identified in ProjectWorlds Advanced Library Management System 1.0. This affects the function mysqli_query of the file returned_book_search.php of the component Search Form. Executing a manipulation of the argument datefrom/dateto can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS