medium · CVSS v3 6.3 · CVSS v4 5.3

CVE-2026-114039

ProjectWorlds Advanced Library Management System 1.0 contains a SQL injection flaw in report_search.php that allows remote manipulation of t

Overview

ProjectWorlds Advanced Library Management System 1.0 contains a SQL injection flaw in report_search.php that allows remote manipulation of the dateto/datefrom parameters. Attackers can inject arbitrary SQL via mysqli_query, potentially exposing or altering database contents.

Description

A weakness has been identified in projectworlds Advanced Library Management System 1.0. Impacted is the function mysqli_query of the file report_search.php. Executing a manipulation of the argument dateto/datefrom can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

Impact

Confidentiality: attackers can read sensitive library data. Integrity: they can modify or delete records. Availability: heavy queries may degrade performance. Impacted parties: system administrators and end‑users of the library system.

Remediation

Apply the vendor’s patch as soon as it is released. Until then, sanitize all user input for dateto/datefrom, preferably using prepared statements or parameterized queries. Validate input ranges and enforce strict data types. If the report_search.php endpoint is not required for remote users, restrict access via firewall or authentication.

Risk context

The vulnerability has a medium severity rating (CVSS 6.3) and no EPSS data is available, indicating a moderate but non‑critical risk that warrants timely remediation.

Affected products

  • ProjectWorlds Advanced Library Management System 1.0

Scores

Severity
medium
CVSS v2
6.5
CVSS v3
6.3
CVSS v4
5.3
EPSS
—

sql-injection web-application database remote medium library-management mysqli

← All CVEs

Related CVEs

medium

CVE-2026-114088

Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the published coordinator-secret value. Attackers can emit READY_FOR_EXECUTION to retrieve decrypted run environment variables or send TASK_RUN_FAILED_TO_RUN and similar events to tamper with arbitrary runs.

View analysis

medium

CVE-2026-92822

CVE-2026-92822 is a denial‑of‑service vulnerability in libmodulemd that allows an attacker to supply deeply nested YAML in the xmd field, causing stack exhaustion or excessive resource consumption during module metadata parsing. The flaw can be triggered by any component that processes modulemd files, such as package managers or container build tools. It does not directly compromise confidentiality or integrity, but it can render affected systems unavailable.

View analysis

medium

CVE-2026-114054

vLLM before 0.31.0 contains a cache aliasing flaw that lets authenticated users collide cache keys via EXIF ImageID or cache_salt, potentially leaking cached media or reusing KV state. The vulnerability can be exploited by supplying crafted values in image metadata or LoRA names. It affects all deployments of vLLM older than 0.31.0.

View analysis

medium

CVE-2026-114056

ArcadeDB versions 26.8.1 to 26.10.0 contain an authorization bypass that lets read‑only users alter edge type schema flags without UPDATE_SCHEMA rights. This change persists across restarts and can affect data integrity.

View analysis