CVE-2025-13255CWE-74CWE-89sql-injection

CVE-2025-13255

Medium · published November 17, 2025

CVSS v3.1

6.3

EPSS

Percentile

35.4

In the wild

Unconfirmed

What it is

A security flaw has been discovered in projectworlds Advanced Library Management System 1.0. This issue affects some unknown processing of the file /book_search.php. Performing a manipulation of the argument book_pub/book_title results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

The record

Technical detail

CVSS v3.1: 6.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0: Not supplied
EPSS: 0.00421 · 35.4th percentile
Weaknesses: CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published: 2025-11-17T06:15Z

Affected products (1)

Product	Versions	Fixed in
projectworlds/advanced_library_management_system	all versions	—

References (6)

https://github.com/Wyg2002yx/cve/blob/main/003/report.md · [email protected]https://github.com/Wyg2002yx/cve/blob/main/004/report.md · [email protected]https://vuldb.com/?ctiid.332590 · [email protected]https://vuldb.com/?id.332590 · [email protected]https://vuldb.com/?submit.687855 · [email protected]https://vuldb.com/?submit.687857 · [email protected]

EPSS history

Timeline

17 NOV 00:32Z
projectworlds Advanced Library Management System book_search.php sql injection
cvelistv5