Projectworlds vulnerabilities
Published CVEs affecting Projectworlds products: 52 record(s), with severity, exploitation and fixes.
Advanced Library Management System 17Online Art Gallery Shop 5Expense Management System 4House Rental and Property Listing 3House Rental And Property Listing Project 3Online Shopping System 2Lawyer Management System 2Car Rental System 2Online Art Gallery Shop Project 2Car Rental Project 2Online Lawyer Management System 2Online Time Table Generator 2Online Food Ordering System 2Gate Pass Management System 2Online Admission System 1Online Notes Sharing Platform 1Online Tours And Travels 1Hospital-management-system-in-php 1Visitor Management System 1Online Notes Sharing System 1Can Pass Malicious Payloads 1Online Ordering Food System 1Online Examination System 1
CVE-2025-14212
Critical · 9.8
CWE-89 Dec 8, 2025
projectworlds Advanced Library Management System member_search.php sql injection
A flaw has been found in projectworlds Advanced Library Management System 1.0. Affected by this issue is some unknown functionality of the file /member_search.php. Executing a manipulation of the argument roll_number can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.
CVE-2025-14211
Critical · 9.8
CWE-89 Dec 8, 2025
projectworlds Advanced Library Management System delete_book.php sql injection
A vulnerability was detected in projectworlds Advanced Library Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /delete_book.php. Performing a manipulation of the argument book_id results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used.
CVE-2025-14210
Critical · 9.8
CWE-89 Dec 8, 2025
projectworlds Advanced Library Management System delete_member.php sql injection
A security vulnerability has been detected in projectworlds Advanced Library Management System 1.0. Affected is an unknown function of the file /delete_member.php. Such manipulation of the argument user_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
CVE-2025-13573
High · 8.8
CWE-434 Nov 23, 2025
projectworlds can pass malicious payloads add_book.php unrestricted upload
A security flaw has been discovered in projectworlds can pass malicious payloads up to 1.0. This vulnerability affects unknown code of the file /add_book.php. The manipulation of the argument image results in unrestricted upload. The attack can be executed remotely. The exploit has been released to the public and may be exploited.
CVE-2025-13572
Critical · 9.8
CWE-89 Nov 23, 2025
projectworlds Advanced Library Management System delete_admin.php sql injection
A vulnerability was identified in projectworlds Advanced Library Management System 1.0. This affects an unknown part of the file /delete_admin.php. The manipulation of the argument admin_id leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
CVE-2025-13278
High · 8.8
CWE-89 Nov 17, 2025
projectworlds Advanced Library Management System borrowed_book_search.php sql injection
A vulnerability has been found in projectworlds Advanced Library Management System 1.0. Impacted is an unknown function of the file /borrowed_book_search.php. Such manipulation of the argument datefrom/dateto leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-13256
High · 8.8
CWE-89 Nov 16, 2025
projectworlds Advanced Library Management System borrow.php sql injection
A weakness has been identified in projectworlds Advanced Library Management System 1.0. Impacted is an unknown function of the file /borrow.php. Executing a manipulation of the argument roll_number can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.
CVE-2025-13255
High · 8.8
CWE-89 Nov 16, 2025
projectworlds Advanced Library Management System book_search.php sql injection
A security flaw has been discovered in projectworlds Advanced Library Management System 1.0. This issue affects some unknown processing of the file /book_search.php. Performing a manipulation of the argument book_pub/book_title results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.
CVE-2025-13254
High · 8.8
CWE-89 Nov 16, 2025
projectworlds Advanced Library Management System add_member.php sql injection
A vulnerability was identified in projectworlds Advanced Library Management System 1.0. This vulnerability affects unknown code of the file /add_member.php. Such manipulation of the argument roll_number leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.
CVE-2025-13253
High · 8.8
CWE-89 Nov 16, 2025
projectworlds Advanced Library Management System add_librarian.php sql injection
A vulnerability was determined in projectworlds Advanced Library Management System 1.0. This affects an unknown part of the file /add_librarian.php. This manipulation of the argument Username causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2025-12938
Critical · 9.8
CWE-89 Nov 10, 2025
projectworlds Online Admission System process_login.php sql injection
A vulnerability was identified in projectworlds Online Admission System 1.0. Affected by this vulnerability is an unknown functionality of the file /process_login.php. The manipulation of the argument keywords leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.
CVE-2025-12862
Critical · 9.8
CWE-434 Nov 7, 2025
projectworlds Online Notes Sharing Platform userprofile.php unrestricted upload
A vulnerability was identified in projectworlds Online Notes Sharing Platform 1.0. Affected by this issue is some unknown functionality of the file /dashboard/userprofile.php. Such manipulation of the argument image leads to unrestricted upload. The attack may be performed from remote. The exploit is publicly available and might be used.
CVE-2025-12237
Critical · 9.8
CWE-89 Oct 27, 2025
projectworlds Advanced Library Management System index.php sql injection
A vulnerability was identified in projectworlds Advanced Library Management System 1.0. Impacted is an unknown function of the file /index.php. Such manipulation of the argument keywords leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used.
CVE-2025-12231
Medium · 4.8
CWE-79 Oct 27, 2025
projectworlds Expense Management System Expense Categories create cross site scripting
A security vulnerability has been detected in projectworlds Expense Management System 1.0. Affected is an unknown function of the file /public/admin/expense_categories/create of the component Expense Categories Page. Such manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
CVE-2025-12230
Medium · 4.8
CWE-79 Oct 27, 2025
projectworlds Expense Management System Currency create cross site scripting
A weakness has been identified in projectworlds Expense Management System 1.0. This impacts an unknown function of the file /public/admin/currencies/create of the component Currency Page. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.
CVE-2025-12229
Medium · 4.8
CWE-79 Oct 27, 2025
projectworlds Expense Management System Roles Page create cross site scripting
A security flaw has been discovered in projectworlds Expense Management System 1.0. This affects an unknown function of the file /public/admin/roles/create of the component Roles Page. The manipulation results in cross site scripting. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
CVE-2025-12228
Medium · 4.8
CWE-79 Oct 27, 2025
projectworlds Expense Management System Users Page create cross site scripting
A vulnerability was identified in projectworlds Expense Management System 1.0. The impacted element is an unknown function of the file /public/admin/users/create of the component Users Page. The manipulation leads to cross site scripting. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.
CVE-2025-12227
Medium · 5.4
CWE-79 Oct 27, 2025
projectworlds Gate Pass Management System add-pass.php cross site scripting
A vulnerability was determined in projectworlds Gate Pass Management System 1.0. The affected element is an unknown function of the file /add-pass.php. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2025-12215
Critical · 9.8
CWE-89 Oct 27, 2025
projectworlds Online Shopping System login_submit.php sql injection
A flaw has been found in projectworlds Online Shopping System 1.0. Impacted is an unknown function of the file /login_submit.php. Executing a manipulation of the argument keywords can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.
CVE-2025-11604
Critical · 9.8
CWE-89 Oct 11, 2025
projectworlds Online Ordering Food System all-orders.php sql injection
A vulnerability was determined in projectworlds Online Ordering Food System 1.0. This issue affects some unknown processing of the file /all-orders.php. This manipulation of the argument Status causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
CVE-2025-11557
Critical · 9.8
CWE-89 Oct 9, 2025
projectworlds Gate Pass Management System add-pass.php sql injection
A vulnerability has been found in projectworlds Gate Pass Management System 1.0. This issue affects some unknown processing of the file /add-pass.php. Such manipulation of the argument fullname leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-11475
Critical · 9.8
CWE-89 Oct 8, 2025
projectworlds Advanced Library Management System view_member.php sql injection
A vulnerability was determined in projectworlds Advanced Library Management System 1.0. Affected by this issue is some unknown functionality of the file /view_member.php. Executing a manipulation of the argument user_id can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2025-11426
High · 8.8
CWE-434 Oct 8, 2025
projectworlds Advanced Library Management System edit_book.php unrestricted upload
A security flaw has been discovered in projectworlds Advanced Library Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /edit_book.php. The manipulation of the argument image results in unrestricted upload. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
CVE-2025-11425
Medium · 4.8
CWE-79 Oct 8, 2025
projectworlds Advanced Library Management System edit_admin.php cross site scripting
A vulnerability was identified in projectworlds Advanced Library Management System 1.0. Affected is an unknown function of the file /edit_admin.php. The manipulation of the argument firstname leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. Other parameters might be affected as well.
CVE-2025-11103
High · 7.2
CWE-284 Sep 28, 2025
Projectworlds Online Tours and Travels change-image.php unrestricted upload
A security vulnerability has been detected in Projectworlds Online Tours and Travels 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/change-image.php. The manipulation of the argument packageimage leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.