Projectworlds vulnerabilities

236 vulnerabilities

Known vulnerabilities in Projectworlds products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 55 products.

Products

50 of 55
6.5CVE-2026-114265projectworldsadvanced library management systemA weakness has been identified in ProjectWorlds Advanced Library Management System 1.0. This affects the function mysqli_query of the file returned_book_search.php of the component Search Form. Executing a manipulation of the argument datefrom/dateto can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.6.5CVE-2026-114266projectworldsadvanced library management systemA security vulnerability has been detected in ProjectWorlds Advanced Library Management System 1.0. This impacts the function mysqli_query of the file profile.php. The manipulation of the argument admin_id leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.7.5CVE-2026-114263projectworldsadvanced library management systemA vulnerability was identified in ProjectWorlds Advanced Library Management System 1.0. The affected element is the function mysqli_query of the file individual_report_search.php. Such manipulation of the argument roll_number leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.5.8CVE-2026-114264projectworldsadvanced library management systemA security flaw has been discovered in ProjectWorlds Advanced Library Management System 1.0. The impacted element is an unknown function of the file edit_member.php. Performing a manipulation of the argument firstname/middlename/lastname/address/branch/type results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.6.5CVE-2026-114039projectworldsadvanced library management system
EPSS score
0.19%
A weakness has been identified in projectworlds Advanced Library Management System 1.0. Impacted is the function mysqli_query of the file report_search.php. Executing a manipulation of the argument dateto/datefrom can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.9.8CVE-2021-43157projectworldsonline_shopping_system
EPSS score
1.17%
Projectsworlds Online Shopping System PHP 1.0 is vulnerable to SQL injection via the id parameter in cart_remove.php.9.8CVE-2021-43628projectworldshospital_management_system_in_php
EPSS score
1.17%
Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via the email parameter in hms-staff.php.8.8CVE-2021-43630projectworldshospital_management_system_in_php
EPSS score
2.07%
Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via multiple parameters in add_patient.php. As a result, an authenticated malicious user can compromise the databases system and in some cases leverage this vulnerability to get remote code execution on the remote web server.9.8CVE-2021-43629projectworldshospital_management_system_in_php
EPSS score
1.17%
Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via multiple parameters in admin_home.php.9.8CVE-2021-43631projectworldshospital_management_system_in_php
EPSS score
1.17%
Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via the appointment_no parameter in payment.php.6.5CVE-2021-43156projectworldsonline_book_store_project_in_php
EPSS score
0.54%
In ProjectWorlds Online Book Store PHP 1.0 a CSRF vulnerability in admin_delete.php allows a remote attacker to delete any book.9.8CVE-2021-43155projectworldsonline_book_store_project_in_php
EPSS score
1.13%
Projectsworlds Online Book Store PHP v1.0 is vulnerable to SQL injection via the "bookisbn" parameter in cart.php.4.3CVE-2021-43158projectworldsonline_shopping_system
EPSS score
0.47%
In ProjectWorlds Online Shopping System PHP 1.0, a CSRF vulnerability in cart_remove.php allows a remote attacker to remove any product in the customer's cart.10CVE-2021-46307projectworldsonline_examination_system
EPSS score
1.56%
An SQL Injection vulnerability exists in Projectworlds Online Examination System 1.0 via the eid parameter in account.php.9.8CVE-2021-46024projectworldsonline-shopping-webvsite-in-php
EPSS score
0.97%
Projectworlds online-shopping-webvsite-in-php 1.0 suffers from a SQL Injection vulnerability via the "id" parameter in cart_add.php, No login is required.7.5CVE-2021-44866projectworldsonline_movie_ticket_booking_system
EPSS score
1.00%
An issue was discovered in Online-Movie-Ticket-Booking-System 1.0. The file about.php does not perform input validation on the 'id' paramter. An attacker can append SQL queries to the input to extract sensitive information from the database.5.3CVE-2021-45852projectworldshospital_management_system_in_php
EPSS score
0.68%
An issue was discovered in Projectworlds Hospital Management System v1.0. Unauthorized malicious attackers can add patients without restriction via add_patient.php.9.8CVE-2025-2065projectworldslife_insurance_management_system
EPSS score
0.54%
A vulnerability, which was classified as critical, was found in projectworlds Life Insurance Management System 1.0. This affects an unknown part of the file /editAgent.php. The manipulation of the argument agent_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.9.8CVE-2025-2657projectworldsapartment_visitors_management_system
EPSS score
0.54%
A vulnerability classified as critical was found in projectworlds Apartment Visitors Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /front.php. The manipulation of the argument rid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.9.8CVE-2025-2064projectworldslife_insurance_management_system
EPSS score
0.54%
A vulnerability, which was classified as critical, has been found in projectworlds Life Insurance Management System 1.0. Affected by this issue is some unknown functionality of the file /deletePayment.php. The manipulation of the argument recipt_no leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.