CVE-2026-129180

{
  "etk_id": "ETK-2026-4440",
  "cve_id": "CVE-2026-129180",
  "display_id": "CVE-2026-129180",
  "ghsa_id": "GHSA-vr8h-pj9q-293w",
  "euvd_id": "EUVD-2026-125822",
  "status": "published",
  "anchor_state": "anchored",
  "title": "SQL injection in projectworlds Visitor Management System",
  "summary": "Projectworlds Visitor Management System 1.0 contains an SQL injection issue in actionpage.php when handling the purpose input. A remote, unauthenticated attacker may manipulate database queries if they can reach the affected application endpoint.",
  "mitigation": "Restrict public access to affected Visitor Management System 1.0 deployments and limit the endpoint to trusted networks or users. Update the application code to use parameterized database queries and validate input; no fixed version is documented in the provided evidence.",
  "vendor": "projectworlds",
  "product": "Visitor Management System",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "1.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Visitor Management System",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 15.8912073,
  "t0_at": "2026-11-13T22:30:09.102000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-13T22:30:09.102000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-13T22:30:09.102000+00:00",
      "url": "https://github.com/advisories/GHSA-vr8h-pj9q-293w"
    }
  }
}