SQL Injection Vulnerability in Projectworlds Visitor Management System
CVE-2026-129180

6.9MEDIUM

Key Information:

Vendor

Projectworlds

Status
Visitor Management System
Vendor
CVE Published:
13 November 2026

What is CVE-2026-129180?

A security flaw has been identified in Projectworlds Visitor Management System version 1.0, which exposes the application to SQL injection attacks. The vulnerability is rooted in the improper handling of arguments in the mysqli_query function located in actionpage.php. This allows an attacker to manipulate SQL queries, potentially leading to unauthorized data access or manipulation. The exploit is publicly available, enabling remote attackers to compromise systems utilizing this version of the software.

Affected Version(s)

Visitor Management System 1.0

References

https://vuldb.com/vuln/437210
vdb-entrytechnical-description
https://vuldb.com/vuln/437210/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-129180
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

shuosheng (VulDB User)
VulDB Vulnerability Moderation Team
.