CVE-2026-4540

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-4540
A vulnerability was detected in projectworlds Online Notes Sharing System 1.0. This issue affects some unknown processing of the file /login.php of the component Parameters Handler. The manipulation of the argument User results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.

7.3 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

7.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://github.com/juzidddd/CVE/issues/4
https://vuldb.com/?ctiid.352357
https://vuldb.com/?id.352357
https://vuldb.com/?submit.774686
Configurations

No configuration.

History

24 Apr 2026, 16:32

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad fue detectada en projectworlds Online Notes Sharing System 1.0. Este problema afecta a un procesamiento desconocido del archivo /login.php del componente Gestor de Parámetros. La manipulación del argumento User resulta en inyección SQL. El ataque puede ser ejecutado remotamente. El exploit es ahora público y puede ser utilizado.

22 Mar 2026, 13:16

Type Values Removed Values Added
Summary (en) A vulnerability was detected in projectworlds Online Notes Sharing System 1.0. This issue affects some unknown processing of the file /login.php of the component Parameters Handler. The manipulation of the argument Benutzer results in SQL Injection. The attack can be executed remotely. The exploit is now public and may be used. (en) A vulnerability was detected in projectworlds Online Notes Sharing System 1.0. This issue affects some unknown processing of the file /login.php of the component Parameters Handler. The manipulation of the argument User results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.

22 Mar 2026, 08:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-22 08:15

Updated : 2026-04-29 01:00

NVD link : CVE-2026-4540

Mitre link : CVE-2026-4540

CVE.ORG link : CVE-2026-4540

JSON object : View

Products Affected

No product.

CWE
CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')