CVE-2026-3406: medium-severity vulnerability in projectworlds Online Art Gallery Shop
projectworlds Online Art Gallery Shop Registration registration.php sql injection
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.9epss 0.4%
A vulnerability was found in projectworlds Online Art Gallery Shop 1.0. The impacted element is an unknown function of the file /admin/registration.php of the component Registration Handler. The manipulation of the argument fname results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
projectworlds · Online Art Gallery ShopRelated CVEs — projectworlds Online Art Gallery Shop
In the same product, most dangerous first.
CVE-2026-3759MEDIUMprojectworlds Online Art Gallery Shop adminHome.php sql injectionEPSS 0.4%CVE-2026-3758MEDIUMprojectworlds Online Art Gallery Shop adminHome.php sql injectionEPSS 0.4%CVE-2026-3757MEDIUMprojectworlds Online Art Gallery Shop pass sql injectionEPSS 0.4%CVE-2026-9364MEDIUMprojectworlds Online Art Gallery Shop adminHome.php sql injectionEPSS 0.3%