Live › vulnerability › CVE-2026-114264
Go to dashboardProjectWorlds Advanced Library Management System 1.0 does not safely handle the firstname, middlename, lastname, address, branch and type fields in edit_member.php, so they can be used for SQL injection. An attacker who can reach the application over the network can read or change its database, and a public exploit has been released.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only installations of ProjectWorlds Advanced Library Management System 1.0 that expose edit_member.php to users who can reach it over the network are exposed. Teams that do not run this application can skip it.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security flaw has been discovered in ProjectWorlds Advanced Library Management System 1.0. The impacted element is an unknown function of the file edit_member.php. Performing a manipulation of the argument firstname/middlename/lastname/address/branch/type results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
This page as .md · .json · in your agent: get_signal("CVE-2026-114264")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.