ProjectWorlds has 39 CVEs on record between 2025 and 2026. Disclosure cadence is accelerating: 6 in the last 90 days against 0 in the 90 before. The busiest recent month was December 2025 with 6. The median CVSS is 6.3 (medium), with 1 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-74 (25) and CWE-89 (25). Most affected products: advanced_library_management_system (17), Advanced Library Management System (5), expense_management_system (4).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.3
- Publish → KEV
- —
- Last 90 days
- 6 prev 0
Products
- advanced_library_management_system 17
- Advanced Library Management System 5
- expense_management_system 4
- gate_pass_management_system 2
- online_shopping_system 2
- online_time_table_generator 2
Worst active — by depth score
CVE-2025-70146Critical· 9.1Missing authentication in multiple administrative action scripts under /admin/ in ProjectWorlds Online Time Table Generator 1.0 allows remote attackers to perform unauthorized administrative operations (e.g.,adding records, deleting reco…62CVE-2025-70147High· 7.5Missing authentication in /admin/student.php and /admin/teacher.php in ProjectWorlds Online Time Table Generator 1.0 allows remote attackers to obtain sensitive information (including plaintext password field values) via direct HTTP GET …53CVE-2026-114263High· 7.3ProjectWorlds Advanced Library Management System individual_report_search.php mysqli_query sql injection52CVE-2026-114266Medium· 6.3ProjectWorlds Advanced Library Management System profile.php mysqli_query sql injection47CVE-2026-114265Medium· 6.3ProjectWorlds Advanced Library Management System Search Form returned_book_search.php mysqli_query sql injection47
ProjectWorlds vulnerabilities
CVEs affecting ProjectWorlds, newest first. Open any entry for full detail, references, and exploit status.
39 CVEsRSS
CVE-2025-11604High· 7.3A vulnerability was determined in projectworlds Online Ordering Food System 1.0
A vulnerability was determined in projectworlds Online Ordering Food System 1.0. This issue affects some unknown processing of the file /all-orders.php. This manipulation of the argument Status causes sql injection. Remote exploitation o…
CVE-2025-11557High· 7.3A vulnerability has been found in projectworlds Gate Pass Management System 1.0
A vulnerability has been found in projectworlds Gate Pass Management System 1.0. This issue affects some unknown processing of the file /add-pass.php. Such manipulation of the argument fullname leads to sql injection. The attack can be e…
CVE-2025-11426Medium· 6.3A security flaw has been discovered in projectworlds Advanced Library Management System 1.0
A security flaw has been discovered in projectworlds Advanced Library Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /edit_book.php. The manipulation of the argument image results in unrestr…
CVE-2025-11425Low· 2.4A vulnerability was identified in projectworlds Advanced Library Management System 1.0
A vulnerability was identified in projectworlds Advanced Library Management System 1.0. Affected is an unknown function of the file /edit_admin.php. The manipulation of the argument firstname leads to cross site scripting. It is possible…
CVE-2025-11475High· 7.3A vulnerability was determined in projectworlds Advanced Library Management System 1.0
A vulnerability was determined in projectworlds Advanced Library Management System 1.0. Affected by this issue is some unknown functionality of the file /view_member.php. Executing a manipulation of the argument user_id can lead to sql i…
CVE-2025-11103Medium· 4.7A security vulnerability has been detected in Projectworlds Online Tours and Travels 1.0
A security vulnerability has been detected in Projectworlds Online Tours and Travels 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/change-image.php. The manipulation of the argument packageimage leads…
CVE-2025-11070High· 7.3A vulnerability was identified in Projectworlds Online Shopping System 1.0
A vulnerability was identified in Projectworlds Online Shopping System 1.0. This affects an unknown part of the file /store/cart_add.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remot…
CVE-2025-11067Low· 2.4A vulnerability has been found in Projectworlds Visitor Management System 1.0
A vulnerability has been found in Projectworlds Visitor Management System 1.0. Affected is an unknown function of the file /myform.php of the component Add Visitor Page. The manipulation of the argument Name leads to cross site scripting…
CVE-2025-9925High· 7.3A vulnerability was found in projectworlds Travel Management System 1.0
A vulnerability was found in projectworlds Travel Management System 1.0. This issue affects some unknown processing of the file /detail.php. The manipulation of the argument pid results in sql injection. The attack can be executed remote…