CVE-2026-114266 Details
Description
A security vulnerability has been detected in ProjectWorlds Advanced Library Management System 1.0. This impacts the function mysqli_query of the file profile.php. The manipulation of the argument admin_id leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
A SQL injection vulnerability has been identified in ProjectWorlds Advanced Library Management System version 1.0. The issue arises in the profile.php file, specifically within the mysqli_query function. The vulnerability is triggered by manipulating the admin_id parameter in the GET query string, allowing for remote exploitation. This flaw has been publicly disclosed and is actively exploitable.
To address this vulnerability, use prepared statements to safely handle the admin_id parameter. Additionally, for profile views, retrieve the admin_id from the session rather than from a user-controlled GET parameter. This change will also mitigate an associated Insecure Direct Object Reference vulnerability, as it will prevent admins from accessing each other's profiles.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/CyberShailendra1/Advanced-Library-Management-System-Project-in-PHP-with-Barcode-profile.php | [email protected] | ExploitTechnical Analysis |
| https://vuldb.com/cve/CVE-2026-114266 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1018754 | [email protected] | Permission Required |
| https://vuldb.com/vuln/424698 | [email protected] | Permission Required |
| https://vuldb.com/vuln/424698/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ProjectWorlds Advanced Library Management System | 1.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 23, 2026 | CVE Modified | CISA-ADP |
| Oct 21, 2026 | New CVE Received | [email protected] |