{"id":"CVE-2026-129181","kind":"vulnerability","aliases":["CVE-2026-129181"],"related":[],"title":"Visitor Management System 1.0: SQL injection in login Username parameter","description":"A vulnerability has been found in projectworlds Visitor Management System 1.0. This issue affects the function mysqli_query of the file /img/user%20page.php of the component Login Endpoint. Such manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.","summary":"projectworlds Visitor Management System 1.0 builds a database query from the Username field on its login endpoint without sanitizing it. A remote attacker can inject SQL through that field to read or change database contents.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Visitor Management System","fixed":[],"affected":"1.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["mysql","other","php","sql-injection","unauthenticated","visitor-management-system"],"not_affected_if":["not-running-this-product"],"how_to_check":"Look for a projectworlds Visitor Management System 1.0 install (PHP/MySQL) and check whether /img/user page.php passes the Username POST value into mysqli_query without prepared statements. Affected version per NVD/VulDB: 1.0.","fix":null,"status":"open","published_at":"2026-11-14T08:17:18+00:00","first_seen_at":"2026-11-14T08:28:34+00:00","triaged_at":"2026-11-14T08:30:14+00:00","updated_at":"2026-11-14T08:31:28+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-14T08:30:14Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Visitor Management System 1.0: SQL injection in login Username parameter","impact":"high","summary":"projectworlds Visitor Management System 1.0 builds a database query from the Username field on its login endpoint without sanitizing it. A remote attacker can inject SQL through that field to read or change database contents.","audience":"businesses","category":"other","nicknames":[],"who_cares":["visitor-management-system","php","mysql"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker reads or alters database records through login form","analyst_note":"Confirm whether a fixed version or patch exists for projectworlds Visitor Management System 1.0 and find a page describing the vulnerable login code path at /img/user%20page.php from the NVD entry.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["not-running-this-product"],"who_is_affected":"Organizations running projectworlds Visitor Management System 1.0 with its login endpoint reachable from the network. The sources do not name a fixed version or a vendor patch, and do not say whether the product is still maintained.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00068,"input_tokens":4556,"output_tokens":448,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm whether a fixed version or patch exists for projectworlds Visitor Management System 1.0 and find a page describing the vulnerable login code path at /img/user%20page.php from the NVD entry.","search":"'-129181':13A,16A '-2026':12A,15A '/img/user':87C '1.0':4A,35B,76C '20page.php':88C 'affect':79C 'argument':98C 'attack':53B,110C 'build':36B 'chang':63B 'compon':91C 'content':65B 'cve':11A,14A 'databas':38B,64B 'disclos':116C 'endpoint':47B,93C 'exploit':113C 'field':43B,59B 'file':86C 'found':70C 'function':81C 'inject':6A,25B,55B,103C 'issu':78C 'launch':108C 'lead':100C 'login':8A,46B,92C 'manag':2A,29B,33B,74C 'management':18A 'manipul':95C 'may':121C 'mysql':20B 'mysqli':82C 'paramet':10A 'php':22B 'possibl':106C 'projectworld':31B,72C 'public':119C 'queri':39B,83C 'read':61B 'remot':52B,111C 'sanit':49B 'sql':5A,24B,56B,102C 'sql-inject':23B 'system':3A,19A,30B,34B,75C 'unauthent':26B 'use':123C 'usernam':9A,42B,99C 'visitor':1A,17A,28B,32B,73C 'visitor-management-system':27B 'vulner':67C 'without':48B","nicknames":[],"mitigations":[],"who_affected":"Organizations running projectworlds Visitor Management System 1.0 with its login endpoint reachable from the network. The sources do not name a fixed version or a vendor patch, and do not say whether the product is still maintained.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["managementsystem","visitormanagementsystem"],"ptokens":["management","system","visitor"],"labels":["high","mysql","other","php","sqlinjection","unauthenticated","visitormanagementsystem"],"campaign_type":null,"search_a":"'-129181':13A,16A '-2026':12A,15A '1.0':4A 'cve':11A,14A 'inject':6A 'login':8A 'manag':2A 'management':18A 'paramet':10A 'sql':5A 'system':3A,19A 'usernam':9A 'visitor':1A,17A","search_b":"'1.0':35B 'attack':53B 'build':36B 'chang':63B 'content':65B 'databas':38B,64B 'endpoint':47B 'field':43B,59B 'inject':25B,55B 'login':46B 'manag':29B,33B 'mysql':20B 'php':22B 'projectworld':31B 'queri':39B 'read':61B 'remot':52B 'sanit':49B 'sql':24B,56B 'sql-inject':23B 'system':30B,34B 'unauthent':26B 'usernam':42B 'visitor':28B,32B 'visitor-management-system':27B 'without':48B","search_c":"'/img/user':87C '1.0':76C '20page.php':88C 'affect':79C 'argument':98C 'attack':110C 'compon':91C 'disclos':116C 'endpoint':93C 'exploit':113C 'file':86C 'found':70C 'function':81C 'inject':103C 'issu':78C 'launch':108C 'lead':100C 'login':92C 'manag':74C 'manipul':95C 'may':121C 'mysqli':82C 'possibl':106C 'projectworld':72C 'public':119C 'queri':83C 'remot':111C 'sql':102C 'system':75C 'use':123C 'usernam':99C 'visitor':73C 'vulner':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T08:17:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129181","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129181","severity":null,"published_at":"2026-11-14T08:17:18+00:00","modified_at":"2026-11-14T08:17:19+00:00","first_seen_at":"2026-11-14T08:28:34+00:00","fetched_at":"2026-11-14T08:28:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-129181:3970","url":"https://vuldb.com/cve/CVE-2026-129181","severity":null,"published_at":"2026-11-14T08:31:28+00:00","modified_at":"2026-11-14T08:31:28+00:00","first_seen_at":"2026-11-14T08:31:28+00:00","fetched_at":"2026-11-14T08:31:28+00:00","note":"No vendor/maintainer advisory or patch found; only NVD (not scheduled for enrichment) and VulDB describe it. Fix unknown, so fix status not claimed. No PoC link or exploitation evidence found.","cites":["https://vuldb.com/cve/CVE-2026-129181","https://nvd.nist.gov/vuln/detail/cve-2026-129181"]}],"documents":[{"id":154082,"url":"https://vuldb.com/cve/CVE-2026-129181","title":"VulDB: CVE-2026-129181 projectworlds Visitor Management System login SQL injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":154083,"url":"https://nvd.nist.gov/vuln/detail/cve-2026-129181","title":"NVD: CVE-2026-129181","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}