TI-2024-00600 Aliases CVE-2024-0650 GHSA-3w7p-hx33-4fxm

Project Worlds Visitor Management System URL dataset.php cross site scripting

HIGH 66CWE-79Published 2024-01-17 · Updated 2024-10-21

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

A vulnerability was found in Project Worlds Visitor Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file dataset.php of the component URL Handler. The manipulation of the argument name with the input "><script>alert('torada')</script> leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-251376.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00681 52nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA and NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
projectworlds	Visitor Management System	1.0	—	No fix listed	CNA

Visitor Management System Vendorprojectworlds Affected 1.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:projectworlds:visitor_management_system:1.0:::::::*	1.0	Vulnerable	projectworlds

cpe:2.3:a:projectworlds:visitor_management_system:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·projectworlds

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2024-0650
2026-10-03 Alias added: GHSA-3w7p-hx33-4fxm

References

Exploit 1

https://torada.notion.site/XSS-at-datatest-php-660aabd1437d4df7a492d19a461a1f3c?pvs=4

TI-2024-15197 SQL injection vulnerability in Projectworlds Visitor Management System in PHP v.1.0… CVSS 3.1HIGH 8.1
TI-2025-08291 projectworlds Visitor Management System visitor_out.php sql injection CVSS 4.0MEDIUM 6.9
TI-2025-08195 projectworlds Visitor Management System front.php sql injection CVSS 4.0MEDIUM 6.9
TI-2025-08194 projectworlds Visitor Management System query_data.php sql injection CVSS 4.0MEDIUM 6.9
TI-2025-10135 Projectworlds Visitor Management System Add Visitor myform.php cross site scripting CVSS 4.0MEDIUM 4.8
TI-2024-15186 An issue in Projectworlds Vistor Management Systemin PHP v.1.0 allows a remtoe attacker… CVSS 3.1CRITICAL 9.8

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences