CVE-2026-114265

Name of the Vulnerable Software and Affected Versions ProjectWorlds Advanced Library Management System version 1.0

Description An issue exists in the Search Form component within the returned book search.php file. A remote attacker can perform SQL injection by manipulating the datefrom and dateto arguments passed to the mysqli query() function. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database.

Recommendations Update ProjectWorlds Advanced Library Management System to a version newer than 1.0. As a temporary mitigation, restrict access to the returned book search.php file or avoid using the datefrom and dateto parameters until a patch is applied.