CVE-2026-129181

Name of the Vulnerable Software and Affected Versions projectworlds Visitor Management System version 1.0

Description An issue exists in the Login Endpoint within the file /img/user%20page.php where the mysqli query() function fails to properly handle the Username variable. This allows a remote attacker to perform SQL injection, a technique used to manipulate database queries to gain unauthorized access or retrieve sensitive data.

Recommendations Update projectworlds Visitor Management System version 1.0 to a patched version. As a temporary mitigation, restrict access to the /img/user%20page.php file or avoid using the Username parameter until a fix is applied.