CVE-2026-4540 - projectworlds Online Notes Sharing System Parameters login.php sql injection

Back Back to CVE browser

MEDIUM

projectworlds Online Notes Sharing System Parameters login.php sql injection

Published Mar 22, 2026

6.9

MEDIUM

CVSS 4.0

EPSS 0.41%

Description

A vulnerability was detected in projectworlds Online Notes Sharing System 1.0. This issue affects some unknown processing of the file /login.php of the component Parameters Handler. The manipulation of the argument User results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.

Affected products

Vendor Projectworlds Product Online Notes Sharing System Default
n/a
- Version
  1.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Projectworlds

Online Notes Sharing System

n/a

Version	Status	Constraints
1.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-74

CWE-89

SQL Injection

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-14289
Advisory
https://github.com/juzidddd/CVE/issues/4
exploitissue-tracking
https://vuldb.com/?ctiid.352357
signaturepermissions-required
https://vuldb.com/?id.352357
vdb-entrytechnical-description
https://vuldb.com/?submit.774686
third-party-advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-14289		Advisory
https://github.com/juzidddd/CVE/issues/4		exploitissue-tracking
https://vuldb.com/?ctiid.352357		signaturepermissions-required
https://vuldb.com/?id.352357		vdb-entrytechnical-description
https://vuldb.com/?submit.774686		third-party-advisory