PT-2026-46408 · Projectworlds · Online Art Gallery Shop Project

Shqnq · CVE-2026-10874 · Published 2026-06-04 · Updated 2026-06-04

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions projectworlds Online Art Gallery Shop Project version 1.0

Description Remote SQL injection is possible through the manipulation of the social insta argument within an unknown function in the '/admin/adminHome.php' endpoint. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database.

Recommendations Update projectworlds Online Art Gallery Shop Project version 1.0 to a version that contains a fix for this issue. As a temporary mitigation, restrict access to the '/admin/adminHome.php' endpoint or avoid using the social insta argument.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2026-10874

Affected Products

Online Art Gallery Shop Project

References · 6

• 🔥 https://github.com/shq3526/cve/issues/9 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-10874 · Security Note
• https://vuldb.com/vuln/368364 · Note
• https://vuldb.com/cve/CVE-2026-10874 · Note
• https://vuldb.com/vuln/368364/cti · Note
• https://vuldb.com/submit/831868 · Note