VISITOR MANAGEMENT SYSTEM · CVE-2026-129180 · Other
NO FIX YET
The projectworlds Visitor Management System 1.0 passes the purpose parameter of actionpage.php into a database query without proper escaping. A remote attacker can inject SQL to read or change the application's database, and a public exploit has been published.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Anyone running the projectworlds Visitor Management System 1.0 (a free PHP/MySQL sample project) with actionpage.php reachable over the network. VulDB states no authentication is needed and a public proof of concept exists. Teams that do not run this application, or keep it off the network, can skip it.
Not affected if application-not-deployed, not-internet-exposed
Who cares mysql, php, self-hosted, sql-injection, unauthenticated, visitor-management
No fix yet, per the sources.
A flaw has been found in projectworlds Visitor Management System 1.0. This vulnerability affects the function mysqli_query of the file actionpage.php. This manipulation of the argument purpose causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.