SQL Injection Vulnerability in Projectworlds Visitor Management System 1.0
CVE-2026-129181

6.9MEDIUM

Key Information:

Vendor

Projectworlds

Status
Visitor Management System
Vendor
CVE Published:
14 November 2026

What is CVE-2026-129181?

A SQL injection vulnerability has been identified in Projectworlds' Visitor Management System 1.0, specifically affecting the 'Login Endpoint' component. The flaw resides in the mysqli_query function located within the file /img/user%20page.php. It allows attackers to manipulate the 'Username' argument, which can lead to unauthorized SQL query execution. This security weakness can be exploited remotely, potentially compromising the application's database and exposing sensitive information. It is vital for users of the affected version to apply necessary patches or updates to mitigate the risk associated with this vulnerability.

Affected Version(s)

Visitor Management System 1.0

References

https://vuldb.com/vuln/437211
vdb-entrytechnical-description
https://vuldb.com/vuln/437211/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-129181
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

shuosheng (VulDB User)
VulDB Vulnerability Moderation Team
.