ProjectWorlds vulnerabilities
We track 123 vulnerabilities in ProjectWorlds products across 37 products. 123 are rated high or critical, and none are known to be exploited. The most recent was published on November 14, 2026.
Latest ProjectWorlds vulnerabilities
- 9.8 Critical severity
Online Doctor Appointment Booking System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in projectworlds Online Doctor Appointment Booking System 1.0 and classified as critical. This vulnerability affects unknown code of the file /patient/patientupdateprofile.php. The manipulation of the argument patientFirstName le
- 9.8 Critical severity
Online Doctor Appointment Booking System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in projectworlds Online Doctor Appointment Booking System 1.0. This affects an unknown part of the file /patient/getschedule.php. The manipulation of the argument q leads to sql injection. It is poss
- 9.8 Critical severity
Online Doctor Appointment Booking System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in projectworlds Online Doctor Appointment Booking System 1.0. Affected by this issue is some unknown functionality of the file /patient/appointment.php?scheduleDate=1&appid=1. The manipulation
- 9.8 Critical severity
Online Doctor Appointment Booking System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in projectworlds Online Doctor Appointment Booking System 1.0. Affected by this vulnerability is an unknown functionality of the file /doctor/deleteschedule.php. The manipulation of the argument ID leads to sql
- 9.8 Critical severity
Online Doctor Appointment Booking System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in projectworlds Online Doctor Appointment Booking System 1.0. Affected is an unknown function of the file /doctor/deletepatient.php. The manipulation of the argument ic leads to sql injection. It is possib
- 9.8 Critical severity
Online Doctor Appointment Booking System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in projectworlds Online Doctor Appointment Booking System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /doctor/deleteappointment.php. The manipulation of the argument ID leads to sql injec
- 9.8 Critical severity
Apartment Visitors Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in projectworlds Apartment Visitors Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /front.php. The manipulation of the argument rid leads to sql injection. The atta
- 9.8 Critical severity
Life Insurance Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in projectworlds Life Insurance Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /search.php. The manipulation of the argument key leads to sql injection. The attack may be initi
- 9.8 Critical severity
Life Insurance Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in projectworlds Life Insurance Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /updateAgent.php. The manipulation of the argument agent_id leads to sql injection. The attack
- 9.8 Critical severity
Life Insurance Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability, which was classified as critical, was found in projectworlds Life Insurance Management System 1.0. This affects an unknown part of the file /editAgent.php. The manipulation of the argument agent_id leads to sql injection. It is possible to ini
- 9.8 Critical severity
Life Insurance Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability, which was classified as critical, has been found in projectworlds Life Insurance Management System 1.0. Affected by this issue is some unknown functionality of the file /deletePayment.php. The manipulation of the argument recipt_no leads to sq
- 9.8 Critical severity
Life Insurance Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability classified as critical was found in projectworlds Life Insurance Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /deleteNominee.php. The manipulation of the argument nominee_id leads to sql injectio
- 9.8 Critical severity
Life Insurance Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability classified as critical has been found in projectworlds Life Insurance Management System 1.0. Affected is an unknown function of the file /clientStatus.php. The manipulation of the argument client_id leads to sql injection. It is possible to lau
- 9.8 Critical severity
Online Hotel Booking: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in projectworlds Online Hotel Booking 1.0. Affected is an unknown function of the file /admin/login.php. The manipulation of the argument emailusername leads to sql injection. It is possible to launch the a
- 9.8 Critical severity
Online Hotel Booking: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in projectworlds Online Hotel Booking 1.0. It has been rated as critical. This issue affects some unknown processing of the file /booknow.php?roomname=Duplex. The manipulation of the argument checkin leads to sql injection. The attack
- 9.8 Critical severity
Online Hotel Booking: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in projectworlds Online Hotel Booking 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /reservation.php. The manipulation of the argument checkin leads to sql injection. The attack can be init
- 9.8 Critical severity
Online Hotel Booking: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in projectworlds Online Hotel Booking 1.0. It has been classified as critical. This affects an unknown part of the file /admin/addroom.php. The manipulation of the argument roomname leads to sql injection. It is possible to initiate t
- 9.8 Critical severity
Online Food Ordering System: Improper Neutralization of Special Elements used in an SQL Command
A SQL Injection vulnerability exists in the login form of Online Food Ordering System v1.0. The vulnerability arises because the input fields username and password are not properly sanitized, allowing attackers to inject malicious SQL queries to bypass authent
- 8.8 High severity
Travel Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in code-projects/projectworlds Travel Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /subcat.php. The manipulation of the argument catid leads to sql injection. The attack
- 9.8 Critical severity
Free Download Online Shopping System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Project Worlds Free Download Online Shopping System up to 192.168.1.88. It has been rated as critical. This issue affects some unknown processing of the file /online-shopping-webvsite-in-php-master/success.php. The manipulation of
- 9.8 Critical severity
travel_management_system: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection in loginform.php in ProjectWorld's Travel Management System v1.0 allows remote attackers to bypass authentication via SQL Injection in the 'username' and 'password' fields.
- 7.5 High severity
travel_management_system: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in projectworlds Travel management System v.1.0 allows a remote attacker to execute arbitrary code via the 't2' parameter in deletesubcategory.php.
- 9.8 Critical severity
Life Insurance Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Project Worlds Life Insurance Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /editNominee.php. The manipulation of the argument nominee_id leads to sql injection. The at
- 9.8 Critical severity
Life Insurance Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Project Worlds Life Insurance Management System 1.0. It has been classified as critical. This affects an unknown part of the file /editPayment.php. The manipulation of the argument recipt_no leads to sql injection. It is possible t
- 8.8 High severity
Online Time Table Generator: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in Project Worlds Online Time Table Generator 1.0. Affected by this vulnerability is an unknown functionality of the file /timetable/staff/staffdashboard.php?info=updateprofile. The manipulation of the argument
- 9.8 Critical severity
Simple Web-Based Chat Application: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in Project Worlds Simple Web-Based Chat Application 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument username leads to sql injecti
- 9.8 Critical severity
Student Project Allocation System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Project Worlds Student Project Allocation System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /student/project_selection/move_up_project.php of the component Project Selection Pag
- 9.8 Critical severity
Student Project Allocation System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in Project Worlds Student Project Allocation System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /student/project_selection/remove_project.php of the component Project Sel
- 9.8 Critical severity
Student Project Allocation System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in Project Worlds Student Project Allocation System 1.0. Affected is an unknown function of the file /student/project_selection/project_selection.php of the component Project Selection Page. The mani
- 8.1 High severity
visitor_management_system_in_php: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in Projectworlds Visitor Management System in PHP v.1.0 allows a remote attacker to escalate privileges via the name parameter in the myform.php endpoint.
- 9.8 Critical severity
Visitor Management System: Improper Privilege Management
An issue in Projectworlds Vistor Management Systemin PHP v.1.0 allows a remtoe attacker to escalate privileges via a crafted script to the login page in the POST/index.php
- 9.8 Critical severity
Lawyer Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Project Worlds Lawyer Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file searchLawyer.php. The manipulation of the argument experience leads to sql inject
- 8.8 High severity
Leave Management System Project: Improper Neutralization of Special Elements used in an SQL Command
Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'setsickleave' parameter of the admin/setleaves.php resource does not validate the characters received and they are sent unfiltered to the database.
- 8.8 High severity
Leave Management System Project: Improper Neutralization of Special Elements used in an SQL Command
Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'setearnleave' parameter of the admin/setleaves.php resource does not validate the characters received and they are sent unfiltered to the database.
- 8.8 High severity
Online Examination System: Improper Neutralization of Special Elements used in an SQL Command
Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'demail' parameter of the /update.php resource does not validate the characters received and they are sent unfiltered to the database.
- 9.8 Critical severity
Online Matrimonial Project: Improper Neutralization of Special Elements used in an SQL Command
Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter of the view_profile.php resource does not validate the characters received and they are sent unfiltered to the database.
- 9.8 Critical severity
Online Food Ordering System: Improper Neutralization of Special Elements used in an SQL Command
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_verified' parameter of the routers/user-router.php resource does not validate the characters received and they are sent unfiltered to the database.
- 9.8 Critical severity
Online Food Ordering System: Improper Neutralization of Special Elements used in an SQL Command
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_role' parameter of the routers/user-router.php resource does not validate the characters received and they are sent unfiltered to the database.
- 9.8 Critical severity
Online Food Ordering System: Improper Neutralization of Special Elements used in an SQL Command
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_deleted' parameter of the routers/user-router.php resource does not validate the characters received and they are sent unfiltered to the database.
- 9.8 Critical severity
Online Food Ordering System: Improper Neutralization of Special Elements used in an SQL Command
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter of the routers/add-ticket.php resource does not validate the characters received and they are sent unfiltered to the database.