Live › vulnerability › CVE-2026-114039
Go to dashboardThe projectworlds Advanced Library Management System 1.0 builds a SQL query in report_search.php from the dateto and datefrom arguments without sanitising them. A remote attacker can alter the database query to read or change library data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running projectworlds Advanced Library Management System 1.0 with report_search.php reachable over the network are exposed. The sources do not say whether authentication is required or what default configuration applies. Installations that do not run this application can skip it.
No product ranges from the sources yet.
report_search.php in the web root of the Advanced Library Management System.1.0, as stated in the sources.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A weakness has been identified in projectworlds Advanced Library Management System 1.0. Impacted is the function mysqli_query of the file report_search.php. Executing a manipulation of the argument dateto/datefrom can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
This page as .md · .json · in your agent: get_signal("CVE-2026-114039")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.