{"id":"CVE-2026-129180","kind":"vulnerability","aliases":["CVE-2026-129180"],"related":[],"title":"projectworlds Visitor Management System: SQL injection in actionpage.php lets attackers query the database","description":"A flaw has been found in projectworlds Visitor Management System 1.0. This vulnerability affects the function mysqli_query of the file actionpage.php. This manipulation of the argument purpose causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.","summary":"The projectworlds Visitor Management System 1.0 passes the purpose parameter of actionpage.php into a database query without proper escaping. A remote attacker can inject SQL to read or change the application's database, and a public exploit has been published.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Visitor Management System","fixed":[],"affected":"1.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["mysql","other","php","self-hosted","sql-injection","unauthenticated","visitor-management"],"not_affected_if":["application-not-deployed","not-internet-exposed"],"how_to_check":"- Look for the projectworlds Visitor Management System (version 1.0) on your web servers: find / -name actionpage.php\n- In actionpage.php, check whether the purpose request value ends up in a mysqli_query string without prepared statements or escaping.\n- Check web logs for requests to actionpage.php with SQL syntax (quotes, UNION, SLEEP) in purpose.\n- Also check any fork or copy of this project that reuses actionpage.php.","fix":null,"status":"open","published_at":"2026-11-13T23:17:19+00:00","first_seen_at":"2026-11-13T23:35:10+00:00","triaged_at":"2026-11-13T23:37:00+00:00","updated_at":"2026-11-13T23:38:20+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-13T23:37:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"projectworlds Visitor Management System: SQL injection in actionpage.php lets attackers query the database","impact":"high","summary":"The projectworlds Visitor Management System 1.0 passes the purpose parameter of actionpage.php into a database query without proper escaping. A remote attacker can inject SQL to read or change the application's database, and a public exploit has been published.","audience":"businesses","category":"other","nicknames":[],"who_cares":["php","visitor-management","mysql"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"database contents readable and modifiable through injected SQL","analyst_note":"Confirm whether a vendor or upstream fix exists and whether authentication is needed; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-129180.","how_to_check":"- Check whether the application runs `projectworlds Visitor Management System` version `1.0` or uses `actionpage.php` with the `purpose` parameter\n- Search the web root for `actionpage.php` and look for `mysqli_query` built from `$_POST` or `$_GET` values without prepared statements","plain_action":"","product_name":"Visitor Management System","needs_analyst":true,"not_affected_if":["application-not-deployed"],"who_is_affected":"Organizations that run the projectworlds Visitor Management System 1.0 web application that exposes actionpage.php to the network. Installations that do not run this application, or that restrict access to it, are less exposed. The sources do not state a fixed version.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000753,"input_tokens":4536,"output_tokens":599,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm whether a vendor or upstream fix exists and whether authentication is needed; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-129180.","search":"'-129180':16A,19A '-2026':15A,18A '1.0':41B,86C 'actionpage.php':8A,47B,97C 'affect':89C 'applic':66B 'argument':102C 'attack':10A,57B,113C 'caus':104C 'chang':64B 'cve':14A,17A 'databas':13A,50B,68B 'escap':54B 'exploit':72B,116C 'file':96C 'flaw':77C 'found':80C 'function':91C 'host':28B 'initi':111C 'inject':6A,31B,59B,106C 'let':9A 'manag':3A,35B,39B,84C 'management':21A 'manipul':99C 'may':121C 'mysql':23B 'mysqli':92C 'paramet':45B 'pass':42B 'php':25B 'possibl':109C 'projectworld':1A,37B,82C 'proper':53B 'public':71B 'publish':75B,119C 'purpos':44B,103C 'queri':11A,51B,93C 'read':62B 'remot':56B,114C 'self':27B 'self-host':26B 'sql':5A,30B,60B,105C 'sql-inject':29B 'system':4A,22A,40B,85C 'unauthent':32B 'use':123C 'visitor':2A,20A,34B,38B,83C 'visitor-manag':33B 'vulner':88C 'without':52B","nicknames":[],"mitigations":[],"who_affected":"Anyone running the projectworlds Visitor Management System 1.0 (a free PHP/MySQL sample project) with actionpage.php reachable over the network. VulDB states no authentication is needed and a public proof of concept exists. Teams that do not run this application, or keep it off the network, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["managementsystem","visitormanagementsystem"],"ptokens":["management","system","visitor"],"labels":["high","mysql","other","php","selfhosted","sqlinjection","unauthenticated","vendor","visitormanagement"],"campaign_type":null,"search_a":"'-129180':16A,19A '-2026':15A,18A 'actionpage.php':8A 'attack':10A 'cve':14A,17A 'databas':13A 'inject':6A 'let':9A 'manag':3A 'management':21A 'projectworld':1A 'queri':11A 'sql':5A 'system':4A,22A 'visitor':2A,20A","search_b":"'1.0':41B 'actionpage.php':47B 'applic':66B 'attack':57B 'chang':64B 'databas':50B,68B 'escap':54B 'exploit':72B 'host':28B 'inject':31B,59B 'manag':35B,39B 'mysql':23B 'paramet':45B 'pass':42B 'php':25B 'projectworld':37B 'proper':53B 'public':71B 'publish':75B 'purpos':44B 'queri':51B 'read':62B 'remot':56B 'self':27B 'self-host':26B 'sql':30B,60B 'sql-inject':29B 'system':40B 'unauthent':32B 'visitor':34B,38B 'visitor-manag':33B 'without':52B","search_c":"'1.0':86C 'actionpage.php':97C 'affect':89C 'argument':102C 'attack':113C 'caus':104C 'exploit':116C 'file':96C 'flaw':77C 'found':80C 'function':91C 'initi':111C 'inject':106C 'manag':84C 'manipul':99C 'may':121C 'mysqli':92C 'possibl':109C 'projectworld':82C 'publish':119C 'purpos':103C 'queri':93C 'remot':114C 'sql':105C 'system':85C 'use':123C 'visitor':83C 'vulner':88C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T23:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129180","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129180","severity":null,"published_at":"2026-11-13T23:17:19+00:00","modified_at":"2026-11-13T23:17:19+00:00","first_seen_at":"2026-11-13T23:35:10+00:00","fetched_at":"2026-11-13T23:35:10+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-129180:3952","url":"https://vuldb.com/vuln/437210","severity":null,"published_at":"2026-11-13T23:38:20+00:00","modified_at":"2026-11-13T23:38:20+00:00","first_seen_at":"2026-11-13T23:38:20+00:00","fetched_at":"2026-11-13T23:38:20+00:00","note":"Only source is VulDB (CNA) VDB-437210: unauthenticated remote SQLi via purpose in actionpage.php, v1.0, PoC public (no link found), no vendor advisory or fix, no countermeasure known; VulDB suggests replacing the product. Nothing verified: no vendor/maintainer page. Not seen exploited. No x search done (obscure product).","cites":["https://vuldb.com/vuln/437210"]}],"documents":[{"id":151022,"url":"https://vuldb.com/vuln/437210","title":"VulDB VDB-437210: projectworlds Visitor Management System 1.0 actionpage.php SQL injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}