Description
A vulnerability was identified in ProjectWorlds Advanced Library Management System 1.0. The affected element is the function mysqli_query of the file individual_report_search.php. Such manipulation of the argument roll_number leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.
Published: 2026-10-21
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote SQL Injection
Action: Mitigate
AI Analysis

Impact

A flaw in the mysqli_query call within individual_report_search.php concatenates the roll_number parameter directly into an SQL statement, enabling attackers to inject arbitrary SQL. This vulnerability allows unauthorized reading, modification, or deletion of data in the library's database, potentially exposing sensitive borrower and item information. The impact is confined to database confidentiality and integrity but does not provide direct access to system code execution.

Affected Systems

ProjectWorlds Advanced Library Management System version 1.0 running the individual_report_search.php component is affected. All installations of this product that expose the roll_number input to users are vulnerable, regardless of network exposure. No specific sub‑versions beyond 1.0 are documented as impacted, but the vulnerability exists in all identified releases of this version.

Risk and Exploitability

The CVSS score of 6.9 places this vulnerability in the medium severity range. EPSS information is not available, and the vulnerability is not currently listed in the CISA KEV catalog. The exploit is publicly available and can be launched remotely by sending crafted roll_number input to the target endpoint. Attackers with remote access, such as web‑based users or remote administrative interfaces, can exploit the flaw to execute arbitrary SQL statements.

Generated by OpenCVE AI on October 22, 2026 at 03:42 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Use parameterized queries instead of concatenating user input into SQL statements in individual_report_search.php.
  • Validate and sanitize the roll_number input to ensure it contains only allowed characters and values before it reaches the database layer.
  • Restrict the privileges of the database user that the application uses to the minimum required; for report retrieval, a read‑only account is sufficient.

Generated by OpenCVE AI on October 22, 2026 at 03:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in ProjectWorlds Advanced Library Management System 1.0. The affected element is the function mysqli_query of the file individual_report_search.php. Such manipulation of the argument roll_number leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.
Title ProjectWorlds Advanced Library Management System individual_report_search.php mysqli_query sql injection
First Time appeared Projectworlds
Projectworlds advanced Library Management System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:projectworlds:advanced_library_management_system:*:*:*:*:*:*:*:*
Vendors & Products Projectworlds
Projectworlds advanced Library Management System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Projectworlds Advanced Library Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-23T22:05:22.435Z

Reserved: 2026-10-21T06:51:33.164Z

Link: CVE-2026-114263

cve-icon Vulnrichment

Updated: 2026-10-23T18:02:50.015Z

cve-icon NVD

Status : Deferred

Published: 2026-10-21T18:17:26.937

Modified: 2026-10-23T23:17:43.133

Link: CVE-2026-114263

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T03:45:18Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')