---
id: "CVE-2026-129180"
page: "https://infrastack.ai/live/CVE-2026-129180"
kind: "vulnerability"
aliases: ["CVE-2026-129180"]
title: "projectworlds Visitor Management System: SQL injection in actionpage.php lets attackers query the database"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Visitor Management System", "fixed": [], "affected": "1.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["mysql", "other", "php", "self-hosted", "sql-injection", "unauthenticated", "visitor-management"]
not_affected_if: ["application-not-deployed", "not-internet-exposed"]
published_at: "2026-11-13T23:17:19+00:00"
first_seen_at: "2026-11-13T23:35:10+00:00"
updated_at: "2026-11-13T23:38:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129180", "first_seen_at": "2026-11-13T23:35:10+00:00"}, {"source": "analyst", "url": "https://vuldb.com/vuln/437210", "first_seen_at": "2026-11-13T23:38:20+00:00", "cites": ["https://vuldb.com/vuln/437210"]}]
exploit_sources: []
---

# projectworlds Visitor Management System: SQL injection in actionpage.php lets attackers query the database

Link for people: https://infrastack.ai/live/CVE-2026-129180 (this .md is for agents)

The projectworlds Visitor Management System 1.0 passes the purpose parameter of actionpage.php into a database query without proper escaping. A remote attacker can inject SQL to read or change the application's database, and a public exploit has been published.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Visitor Management System affected 1.0 fixed no fixed version listed

## How to check

- Look for the projectworlds Visitor Management System (version 1.0) on your web servers: find / -name actionpage.php
- In actionpage.php, check whether the purpose request value ends up in a mysqli_query string without prepared statements or escaping.
- Check web logs for requests to actionpage.php with SQL syntax (quotes, UNION, SLEEP) in purpose.
- Also check any fork or copy of this project that reuses actionpage.php.

## Timeline

- 2026-11-13T23:35:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129180
- 2026-11-13T23:38:20+00:00 analyst https://vuldb.com/vuln/437210 — Only source is VulDB (CNA) VDB-437210: unauthenticated remote SQLi via purpose in actionpage.php, v1.0, PoC public (no link found), no vendor advisory or fix, no countermeasure known; VulDB suggests replacing the product. Nothing verified: no vendor/maintainer page. Not seen exploited. No x search done (obscure product).

## Documents

- [advisory] VulDB VDB-437210: projectworlds Visitor Management System 1.0 actionpage.php SQL injection https://vuldb.com/vuln/437210

## From the sources

A flaw has been found in projectworlds Visitor Management System 1.0. This vulnerability affects the function mysqli_query of the file actionpage.php. This manipulation of the argument purpose causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_