High severity · published Sep 30, 2020
CVE-2020-25760
Projectworlds Visitor Management System in PHP 1.0 allows SQL Injection
8.8
CVSS
2.2%
EPSS
No
On KEV
Description
Projectworlds Visitor Management System in PHP 1.0 allows SQL Injection. The file front.php does not perform input validation on the 'rid' parameter. An attacker can append SQL queries to the input to extract sensitive information from the database.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VM
Visitor Management System · Projectworlds
1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-25760
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-25760
Exploit
http://packetstormsecurity.com/files/159262/Visitor-Management-System-In-PHP-1.0-SQL-Injection.html
Exploit
http://packetstormsecurity.com/files/159637/Visitor-Management-System-In-PHP-1.0-SQL-Injection.html
Exploit
http://seclists.org/fulldisclosure/2020/Sep/43
Exploit
https://packetstormsecurity.com/files/author/15149/
www.exploit-db.com
https://www.exploit-db.com/exploits/48911
More from Visitor Management System
9.8
CVE-2025-9047
A vulnerability has been found in projectworlds Visitor Management System 1.0
9.8
CVE-2025-8948
A vulnerability was determined in projectworlds Visitor Management System 1.0
9.8
CVE-2025-8947
A vulnerability was found in projectworlds Visitor Management System 1.0
9.8
CVE-2024-22922
An issue in Projectworlds Vistor Management Systemin PHP v.1.0 allows a remtoe attacker to escalate privileges via a crafted script to the login page in the POST/index.php
8.1
CVE-2024-22983
SQL injection vulnerability in Projectworlds Visitor Management System in PHP v.1.0 allows a remote attacker to escalate privileges via the name parameter in the myform.php…