projectworlds has 39 CVEs on record between 2025 and 2026. Disclosure cadence is accelerating: 6 in the last 90 days against 0 in the 90 before. The busiest recent month was November 2025 with 9. The median CVSS is 6.3 (medium), with 1 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-74 (25) and CWE-89 (25). Most affected products: advanced_library_management_system (17), Advanced Library Management System (5), expense_management_system (4).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.3
- Publish → KEV
- —
- Last 90 days
- 6 prev 0
Products
- advanced_library_management_system 17
- Advanced Library Management System 5
- expense_management_system 4
- gate_pass_management_system 2
- online_shopping_system 2
- online_time_table_generator 2
Worst active — by depth score
CVE-2025-70146Critical· 9.1Missing authentication in multiple administrative action scripts under /admin/ in ProjectWorlds Online Time Table Generator 1.0 allows remote attackers to perform unauthorized administrative operations (e.g.,adding records, deleting reco…62CVE-2025-70147High· 7.5Missing authentication in /admin/student.php and /admin/teacher.php in ProjectWorlds Online Time Table Generator 1.0 allows remote attackers to obtain sensitive information (including plaintext password field values) via direct HTTP GET …53CVE-2026-114263High· 7.3ProjectWorlds Advanced Library Management System individual_report_search.php mysqli_query sql injection52CVE-2026-114266Medium· 6.3ProjectWorlds Advanced Library Management System profile.php mysqli_query sql injection47CVE-2026-114039Medium· 6.3projectworlds Advanced Library Management System report_search.php mysqli_query sql injection47
projectworlds vulnerabilities
CVEs affecting projectworlds, newest first. Open any entry for full detail, references, and exploit status.
39 CVEsRSS
CVE-2026-114266Medium· 6.3PoCProjectWorlds Advanced Library Management System profile.php mysqli_query sql injection
A security vulnerability has been detected in ProjectWorlds Advanced Library Management System 1.0. This impacts the function mysqli_query of the file profile.php. The manipulation of the argument admin_id leads to sql injection. The att…
CVE-2026-114263High· 7.3PoCProjectWorlds Advanced Library Management System individual_report_search.php mysqli_query sql injection
A vulnerability was identified in ProjectWorlds Advanced Library Management System 1.0. The affected element is the function mysqli_query of the file individual_report_search.php. Such manipulation of the argument roll_number leads to sq…
CVE-2026-114264Medium· 4.7PoCProjectWorlds Advanced Library Management System edit_member.php sql injection
A security flaw has been discovered in ProjectWorlds Advanced Library Management System 1.0. The impacted element is an unknown function of the file edit_member.php. Performing a manipulation of the argument firstname/middlename/lastname…
CVE-2026-114265Medium· 6.3ProjectWorlds Advanced Library Management System Search Form returned_book_search.php mysqli_query sql injection
A weakness has been identified in ProjectWorlds Advanced Library Management System 1.0. This affects the function mysqli_query of the file returned_book_search.php of the component Search Form. Executing a manipulation of the argument da…
CVE-2026-114039Medium· 6.3PoCprojectworlds Advanced Library Management System report_search.php mysqli_query sql injection
A weakness has been identified in projectworlds Advanced Library Management System 1.0. Impacted is the function mysqli_query of the file report_search.php. Executing a manipulation of the argument dateto/datefrom can lead to sql injecti…
CVE-2026-86238Medium· 4.3PoCA vulnerability was determined in projectworlds Online Examination System 1.0
A vulnerability was determined in projectworlds Online Examination System 1.0. The affected element is an unknown function of the file feedback.php of the component Feedback Form. Executing a manipulation of the argument Name/Subject can…
CVE-2025-70147High· 7.5PoCMissing authentication in /admin/student.php and /admin/teacher.php in ProjectWorlds Online Time Table Generator 1.0 allows remote attackers to obtain sensitive information (including plaintext password field values) via direct HTTP GET …
Missing authentication in /admin/student.php and /admin/teacher.php in ProjectWorlds Online Time Table Generator 1.0 allows remote attackers to obtain sensitive information (including plaintext password field values) via direct HTTP GET …
CVE-2025-70146Critical· 9.1PoCMissing authentication in multiple administrative action scripts under /admin/ in ProjectWorlds Online Time Table Generator 1.0 allows remote attackers to perform unauthorized administrative operations (e.g.,adding records, deleting reco…
Missing authentication in multiple administrative action scripts under /admin/ in ProjectWorlds Online Time Table Generator 1.0 allows remote attackers to perform unauthorized administrative operations (e.g.,adding records, deleting reco…
CVE-2025-14571High· 7.3A vulnerability has been found in projectworlds Advanced Library Management System 1.0
A vulnerability has been found in projectworlds Advanced Library Management System 1.0. Affected by this issue is some unknown functionality of the file /borrow_book.php. Such manipulation of the argument roll_number leads to sql injecti…
CVE-2025-14570High· 7.3A flaw has been found in projectworlds Advanced Library Management System 1.0
A flaw has been found in projectworlds Advanced Library Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /view_admin.php. This manipulation of the argument admin_id causes sql injection. The a…
CVE-2025-14527High· 7.3A weakness has been identified in projectworlds Advanced Library Management System 1.0
A weakness has been identified in projectworlds Advanced Library Management System 1.0. This vulnerability affects unknown code of the file /view_book.php. Executing a manipulation of the argument book_id can lead to sql injection. The a…
CVE-2025-14212High· 7.3A flaw has been found in projectworlds Advanced Library Management System 1.0
A flaw has been found in projectworlds Advanced Library Management System 1.0. Affected by this issue is some unknown functionality of the file /member_search.php. Executing a manipulation of the argument roll_number can lead to sql inje…
CVE-2025-14211High· 7.3A vulnerability was detected in projectworlds Advanced Library Management System 1.0
A vulnerability was detected in projectworlds Advanced Library Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /delete_book.php. Performing a manipulation of the argument book_id results in s…
CVE-2025-14210High· 7.3A security vulnerability has been detected in projectworlds Advanced Library Management System 1.0
A security vulnerability has been detected in projectworlds Advanced Library Management System 1.0. Affected is an unknown function of the file /delete_member.php. Such manipulation of the argument user_id leads to sql injection. The att…
CVE-2025-13573Medium· 6.3A security flaw has been discovered in projectworlds can pass malicious payloads up to 1.0
A security flaw has been discovered in projectworlds can pass malicious payloads up to 1.0. This vulnerability affects unknown code of the file /add_book.php. The manipulation of the argument image results in unrestricted upload. The att…
CVE-2025-13572High· 7.3A vulnerability was identified in projectworlds Advanced Library Management System 1.0
A vulnerability was identified in projectworlds Advanced Library Management System 1.0. This affects an unknown part of the file /delete_admin.php. The manipulation of the argument admin_id leads to sql injection. Remote exploitation of …
CVE-2025-13278Medium· 6.3A vulnerability has been found in projectworlds Advanced Library Management System 1.0
A vulnerability has been found in projectworlds Advanced Library Management System 1.0. Impacted is an unknown function of the file /borrowed_book_search.php. Such manipulation of the argument datefrom/dateto leads to sql injection. The …
CVE-2025-13256Medium· 6.3A weakness has been identified in projectworlds Advanced Library Management System 1.0
A weakness has been identified in projectworlds Advanced Library Management System 1.0. Impacted is an unknown function of the file /borrow.php. Executing a manipulation of the argument roll_number can lead to sql injection. It is possib…
CVE-2025-13255Medium· 6.3A security flaw has been discovered in projectworlds Advanced Library Management System 1.0
A security flaw has been discovered in projectworlds Advanced Library Management System 1.0. This issue affects some unknown processing of the file /book_search.php. Performing a manipulation of the argument book_pub/book_title results i…
CVE-2025-13254Medium· 6.3A vulnerability was identified in projectworlds Advanced Library Management System 1.0
A vulnerability was identified in projectworlds Advanced Library Management System 1.0. This vulnerability affects unknown code of the file /add_member.php. Such manipulation of the argument roll_number leads to sql injection. The attack…
CVE-2025-13253Medium· 6.3A vulnerability was determined in projectworlds Advanced Library Management System 1.0
A vulnerability was determined in projectworlds Advanced Library Management System 1.0. This affects an unknown part of the file /add_librarian.php. This manipulation of the argument Username causes sql injection. The attack is possible …
CVE-2025-12938High· 7.3A vulnerability was identified in projectworlds Online Admission System 1.0
A vulnerability was identified in projectworlds Online Admission System 1.0. Affected by this vulnerability is an unknown functionality of the file /process_login.php. The manipulation of the argument keywords leads to sql injection. The…
CVE-2025-12862Medium· 6.3A vulnerability was identified in projectworlds Online Notes Sharing Platform 1.0
A vulnerability was identified in projectworlds Online Notes Sharing Platform 1.0. Affected by this issue is some unknown functionality of the file /dashboard/userprofile.php. Such manipulation of the argument image leads to unrestricted…
CVE-2025-12237High· 7.3A vulnerability was identified in projectworlds Advanced Library Management System 1.0
A vulnerability was identified in projectworlds Advanced Library Management System 1.0. Impacted is an unknown function of the file /index.php. Such manipulation of the argument keywords leads to sql injection. The attack can be executed…
CVE-2025-12231Low· 2.4A security vulnerability has been detected in projectworlds Expense Management System 1.0
A security vulnerability has been detected in projectworlds Expense Management System 1.0. Affected is an unknown function of the file /public/admin/expense_categories/create of the component Expense Categories Page. Such manipulation le…
CVE-2025-12230Low· 2.4A weakness has been identified in projectworlds Expense Management System 1.0
A weakness has been identified in projectworlds Expense Management System 1.0. This impacts an unknown function of the file /public/admin/currencies/create of the component Currency Page. This manipulation causes cross site scripting. It…
CVE-2025-12229Low· 2.4A security flaw has been discovered in projectworlds Expense Management System 1.0
A security flaw has been discovered in projectworlds Expense Management System 1.0. This affects an unknown function of the file /public/admin/roles/create of the component Roles Page. The manipulation results in cross site scripting. Th…
CVE-2025-12228Low· 2.4A vulnerability was identified in projectworlds Expense Management System 1.0
A vulnerability was identified in projectworlds Expense Management System 1.0. The impacted element is an unknown function of the file /public/admin/users/create of the component Users Page. The manipulation leads to cross site scripting…
CVE-2025-12227Low· 3.5A vulnerability was determined in projectworlds Gate Pass Management System 1.0
A vulnerability was determined in projectworlds Gate Pass Management System 1.0. The affected element is an unknown function of the file /add-pass.php. Executing a manipulation can lead to cross site scripting. The attack can be executed…
CVE-2025-12215High· 7.3A flaw has been found in projectworlds Online Shopping System 1.0
A flaw has been found in projectworlds Online Shopping System 1.0. Impacted is an unknown function of the file /login_submit.php. Executing a manipulation of the argument keywords can lead to sql injection. The attack may be launched rem…