High severity · published Nov 17, 2025
CVE-2025-13256
A weakness has been identified in projectworlds Advanced Library Management System 1.0
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
A weakness has been identified in projectworlds Advanced Library Management System 1.0. Impacted is an unknown function of the file /borrow.php. Executing a manipulation of the argument roll_number can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AL
Advanced Library Management System · Projectworlds
1.0 · source: NVD
Affected product
AL
Advanced Library Management System
Projectworlds
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-13256
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-13256
Exploit
https://github.com/Wyg2002yx/cve/blob/main/005/report.md
Permissions Required
https://vuldb.com/?ctiid.332591
Third Party Advisory
https://vuldb.com/?id.332591
Third Party Advisory
https://vuldb.com/?submit.687856
More from Advanced Library Management System
9.8
CVE-2025-14571
projectworlds Advanced Library Management System borrow_book.php sql injection
9.8
CVE-2025-14570
projectworlds Advanced Library Management System view_admin.php sql injection
9.8
CVE-2025-14527
projectworlds Advanced Library Management System view_book.php sql injection
9.8
CVE-2025-14212
A flaw has been found in projectworlds Advanced Library Management System 1.0
9.8
CVE-2025-14211
A vulnerability was detected in projectworlds Advanced Library Management System 1.0