CVE-2025-9047

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability has been found in projectworlds Visitor Management System 1.0. Affected is an unknown function of the file /visitor_out.php. The manipulation of the argument rid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
projectworlds	Visitor Management System	1.0

References

https://github.com/guoma-book/CVE/issues/2Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.320268Permissions Required
https://vuldb.com/?id.320268Third Party Advisory, VDB Entry
https://vuldb.com/?submit.631994Third Party Advisory, VDB Entry

Timeline

Published: Aug 15, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-90488.1The Wptobe-memberships plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the del_img CVE-2025-90498.8The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability che CVE-2025-90509.8A vulnerability was found in projectworlds Travel Management System 1.0. Affected by this vulnerability is an unknown functionality of the f CVE-2025-90519.8A vulnerability was determined in projectworlds Travel Management System 1.0. Affected by this issue is some unknown functionality of the fi CVE-2025-90529.8A vulnerability was identified in projectworlds Travel Management System 1.0. This affects an unknown part of the file /updatepackage.php. T CVE-2025-90539.8A vulnerability has been found in projectworlds Travel Management System 1.0. This vulnerability affects unknown code of the file /updatesub CVE-2025-90549.8The MultiLoca - WooCommerce Multi Locations Inventory Management plugin for WordPress is vulnerable to unauthorized modification of data tha CVE-2025-90556.4The VAPIX Edge storage API that allowed a privilege escalation, enabling a VAPIX administrator-privileged user to gain Linux Root privileges CVE-2025-90565.3Unprotected service in the AudioLink component allows a local attacker to overwrite system files via unauthorized service invocation.CVE-2025-90576.4The Biagiotti Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 2.1.3 CVE-2025-90586.4The Mikado Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.5.2 due CVE-2025-90598.8The Altiris Core Agent Updater package (AeXNSC.exe) is prone to an elevation of privileges vulnerability through DLL hijacking.