Project Worlds vulnerabilities, page 2

33 vulnerabilities

Known vulnerabilities in Project Worlds products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 10 products.

9.8CriticalCVE-2024-0498project worlds · lawyer management system +1 moreProject Worlds Lawyer Management System searchLawyer.php sql injectionA vulnerability was found in Project Worlds Lawyer Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file searchLawyer.php. The manipulation of the argument experience leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250603.EPSS0.50%9.8CriticalCVE-2024-0730project worlds · online time table generator +1 moreProject Worlds Online Time Table Generator course_ajax.php sql injectionA vulnerability, which was classified as critical, was found in Project Worlds Online Time Table Generator 1.0. This affects an unknown part of the file course_ajax.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-251553 was assigned to this vulnerability.EPSS0.59%5.4MediumCVE-2024-0266project worlds · online lawyer management system +1 moreProject Worlds Online Lawyer Management System User Registration cross site scriptingA vulnerability classified as problematic has been found in Project Worlds Online Lawyer Management System 1.0. Affected is an unknown function of the component User Registration. The manipulation of the argument First Name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249822 is the identifier assigned to this vulnerability.EPSS0.68%6.1MediumCVE-2024-0650project worlds · visitor management system +1 moreProject Worlds Visitor Management System URL dataset.php cross site scriptingA vulnerability was found in Project Worlds Visitor Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file dataset.php of the component URL Handler. The manipulation of the argument name with the input "><script>alert('torada')</script> leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-251376.EPSS0.68%6.1MediumCVE-2024-10433project worlds · simple web-based chat application +1 moreProject Worlds Simple Web-Based Chat Application index.php cross site scriptingA vulnerability was found in Project Worlds Simple Web-Based Chat Application 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument Name/Comment leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory mentions different parameters to be affected which do not correlate with the screenshots of a successful attack.EPSS0.43%9.8CriticalCVE-2024-10425project worlds · student project allocation system +1 moreProject Worlds Student Project Allocation System Project Selection Page move_up_project.php sql injectionA vulnerability was found in Project Worlds Student Project Allocation System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /student/project_selection/move_up_project.php of the component Project Selection Page. The manipulation of the argument up leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.EPSS0.57%9.8CriticalCVE-2024-10734project worlds · life insurance management system +1 moreProject Worlds Life Insurance Management System editPayment.php sql injectionA vulnerability was found in Project Worlds Life Insurance Management System 1.0. It has been classified as critical. This affects an unknown part of the file /editPayment.php. The manipulation of the argument recipt_no leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.EPSS0.53%7.2HighCVE-2024-10446project worlds · online time table generator +1 moreProject Worlds Online Time Table Generator admindashboard.php sql injectionA vulnerability classified as critical has been found in Project Worlds Online Time Table Generator 1.0. Affected is an unknown function of the file /timetable/admin/admindashboard.php?info=add_course. The manipulation of the argument c leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.EPSS0.54%9.8CriticalCVE-2024-10735project worlds · life insurance management system +1 moreProject Worlds Life Insurance Management System editNominee.php sql injectionA vulnerability was found in Project Worlds Life Insurance Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /editNominee.php. The manipulation of the argument nominee_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.EPSS0.53%8.8HighCVE-2024-10447project worlds · online time table generator +1 moreProject Worlds Online Time Table Generator staffdashboard.php sql injectionA vulnerability classified as critical was found in Project Worlds Online Time Table Generator 1.0. Affected by this vulnerability is an unknown functionality of the file /timetable/staff/staffdashboard.php?info=updateprofile. The manipulation of the argument n leads to sql injection. The attack can be launched remotely.EPSS0.48%9.8CriticalCVE-2024-10432project worlds · simple web-based chat application +1 moreProject Worlds Simple Web-Based Chat Application index.php sql injectionA vulnerability has been found in Project Worlds Simple Web-Based Chat Application 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.EPSS0.64%9.8CriticalCVE-2024-10424project worlds · student project allocation system +1 moreProject Worlds Student Project Allocation System Project Selection Page remove_project.php sql injectionA vulnerability has been found in Project Worlds Student Project Allocation System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /student/project_selection/remove_project.php of the component Project Selection Page. The manipulation of the argument no leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.EPSS0.57%9.8CriticalCVE-2024-10423project worlds · student project allocation system +1 moreProject Worlds Student Project Allocation System Project Selection Page project_selection.php sql injectionA vulnerability, which was classified as critical, was found in Project Worlds Student Project Allocation System 1.0. Affected is an unknown function of the file /student/project_selection/project_selection.php of the component Project Selection Page. The manipulation of the argument project_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.EPSS0.53%