CVE-2025-8947 MEDIUM

CVE-2025-8947: projectworlds Visitor Management System query_data.php sql injection

Vendor Projectworlds

Product Visitor Management System

Weakness CWE-89 · SQLi

Published August 14, 2025

Last update August 14, 2025

View on NVD All CVEs

CVSS base score

6.9/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability was found in projectworlds Visitor Management System 1.0. This issue affects some unknown processing of the file /query_data.php. The manipulation of the argument dateF/dateP leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Key dates

02Disclosure timeline

August 14, 2025 CVE published

August 14, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-8947 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html

Related vulnerabilities

04Related CVE

CVE-2023-2955 SourceCodester Students Online Internship Timesheet System GET Parameter rendered_report.php sql injection CVE-2025-3151 SourceCodester Gym Management System signup.php sql injection CVE-2026-2094 Flowring｜Docpedia - SQL Injection CVE-2024-10195 Tecno 4G Portable WiFi TR118 SMS Check goform_get_cmd_process sql injection CVE-2026-6225 Taskbuilder – Project Management & Task Management Tool With Kanban Board <= 5.0.6 - Authenticated (Subscriber+) Time-Based Blind SQL Injection via 'project_search' Parameter