---
id: "CVE-2026-129181"
page: "https://infrastack.ai/live/CVE-2026-129181"
kind: "vulnerability"
aliases: ["CVE-2026-129181"]
title: "Visitor Management System 1.0: SQL injection in login Username parameter"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Visitor Management System", "fixed": [], "affected": "1.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["mysql", "other", "php", "sql-injection", "unauthenticated", "visitor-management-system"]
not_affected_if: ["not-running-this-product"]
published_at: "2026-11-14T08:17:18+00:00"
first_seen_at: "2026-11-14T08:28:34+00:00"
updated_at: "2026-11-14T08:31:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129181", "first_seen_at": "2026-11-14T08:28:34+00:00"}, {"source": "analyst", "url": "https://vuldb.com/cve/CVE-2026-129181", "first_seen_at": "2026-11-14T08:31:28+00:00", "cites": ["https://vuldb.com/cve/CVE-2026-129181", "https://nvd.nist.gov/vuln/detail/cve-2026-129181"]}]
exploit_sources: []
---

# Visitor Management System 1.0: SQL injection in login Username parameter

Link for people: https://infrastack.ai/live/CVE-2026-129181 (this .md is for agents)

projectworlds Visitor Management System 1.0 builds a database query from the Username field on its login endpoint without sanitizing it. A remote attacker can inject SQL through that field to read or change database contents.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Visitor Management System affected 1.0 fixed no fixed version listed

## How to check

Look for a projectworlds Visitor Management System 1.0 install (PHP/MySQL) and check whether /img/user page.php passes the Username POST value into mysqli_query without prepared statements. Affected version per NVD/VulDB: 1.0.

## Timeline

- 2026-11-14T08:28:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129181
- 2026-11-14T08:31:28+00:00 analyst https://vuldb.com/cve/CVE-2026-129181 — No vendor/maintainer advisory or patch found; only NVD (not scheduled for enrichment) and VulDB describe it. Fix unknown, so fix status not claimed. No PoC link or exploitation evidence found.

## Documents

- [describes] VulDB: CVE-2026-129181 projectworlds Visitor Management System login SQL injection https://vuldb.com/cve/CVE-2026-129181
- [mentions] NVD: CVE-2026-129181 https://nvd.nist.gov/vuln/detail/cve-2026-129181

## From the sources

A vulnerability has been found in projectworlds Visitor Management System 1.0. This issue affects the function mysqli_query of the file /img/user%20page.php of the component Login Endpoint. Such manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_