PT-2026-27308 · Projectworlds · Lawyer Management System

Wangyiqi · Published 2026-03-24 · Updated 2026-03-25 · CVE-2026-4626

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions projectworlds Lawyer Management System version 1.0

Description A flaw exists in projectworlds Lawyer Management System 1.0. The issue is related to cross site scripting, triggered by manipulating the Description argument in the /lawyer booking.php file. This can be exploited remotely. The exploit for this issue is publicly available.

Recommendations Apply any available updates or patches for projectworlds Lawyer Management System version 1.0. As a temporary workaround, sanitize the Description input to prevent script injection. Restrict access to the /lawyer booking.php file if possible.

Exploit

Fix

Code Injection

XSS

Weakness Enumeration

CWE-94

CWE-79

Related Identifiers

CVE-2026-4626

Affected Products

Lawyer Management System

References · 7

• 🔥 https://github.com/eqiya17/collection-of-vulnerability/issues/2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4626 · Security Note
• https://twitter.com/CVEarity/status/2036847365156647209 · Twitter Post
• https://vuldb.com/?submit.775791 · Note
• https://vuldb.com/?ctiid.352494 · Note
• https://twitter.com/fernandokarl/status/2036475373798478242 · Twitter Post
• https://vuldb.com/?id.352494 · Note