CVE-2026-3406

CRITICAL WAF: High
CVSS 9.8 Published: 2026-03-02
CWE-89 CWE-89

A vulnerability was found in projectworlds Online Art Gallery Shop 1.0. The impacted element is an unknown function of the file /admin/registration.php of the component Registration Handler. The manipulation of the argument fname results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.

WAF Coverage Analysis

SQL Injection High WAF Coverage

OWASP: A03:2021 Injection

942xxx - SQL Injection
SQL Injection High WAF Coverage

OWASP: A03:2021 Injection

942xxx - SQL Injection

Affected Software

VendorProductVersion
projectworldsonline_art_gallery_shop1.0

References

  • github.com (Exploit, Third Party Advisory, Issue Tracking)
  • vuldb.com (Permissions Required, VDB Entry)
  • vuldb.com (Third Party Advisory, VDB Entry)
  • vuldb.com (Exploit, Third Party Advisory, VDB Entry)
Back to CVE Database