VISITOR MANAGEMENT SYSTEM · CVE-2026-129181 · Other
NO FIX YET
projectworlds Visitor Management System 1.0 builds a database query from the Username field on its login endpoint without sanitizing it. A remote attacker can inject SQL through that field to read or change database contents.
first public Nov 14, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Organizations running projectworlds Visitor Management System 1.0 with its login endpoint reachable from the network. The sources do not name a fixed version or a vendor patch, and do not say whether the product is still maintained.
Not affected if not-running-this-product
Who cares mysql, php, sql-injection, unauthenticated, visitor-management-system
No fix yet, per the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
A vulnerability has been found in projectworlds Visitor Management System 1.0. This issue affects the function mysqli_query of the file /img/user%20page.php of the component Login Endpoint. Such manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.