CVE-2026-4540
projectworlds Online Notes Sharing System Parameters login.php sql injection
- State
- Published
- Severity
- 6.9 Medium
- Published
- Mar 22, 2026
- Updated
- Mar 24, 2026
- Reserved
- Mar 21, 2026
Description
A vulnerability was detected in projectworlds Online Notes Sharing System 1.0. This issue affects some unknown processing of the file /login.php of the component Parameters Handler. The manipulation of the argument User results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 7.3 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 7.3 High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 7.5 High | AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Online Notes Sharing Systemprojectworlds |
|
References
- VDB-352357 | projectworlds Online Notes Sharing System Parameters login.php sql injectionvdb-entrytechnical-description
- VDB-352357 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #774686 | projectworlds Online Notes Sharing System 1.0 SQL Injectionthird-party-advisory
- https://github.com/juzidddd/CVE/issues/4exploitissue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.