The Library Management System Project maintains a focused but widely deployed library management application that serves educational institutions, municipal systems, and organizational information services. Vulnerabilities affecting this vendor skew strongly toward critical-severity outcomes and recur persistently across a narrow product line through application-layer weakness classes including SQL injection, cross-site scripting, and unrestricted file uploads—flaws that reflect the web-facing data-handling and user-input processing demands of a database-backed information system. These vulnerability classes are particularly consequential in library systems because they operate on sensitive patron data, catalog holdings, and administrative functions, and because many deployments remain internet-accessible with legacy configurations. Defenders should prioritize patches for this vendor's application and enforce input validation, output encoding, and file-type restrictions at the application layer; live severity and exploitation figures are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Library Management System Project over time
Signals from CVEs in this vendor scope (34 CVEs).
34 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-37794CRITICAL In Library Management System 1.0 the /card/in-card.php file id_no parameters are vulnerable to SQL injection. | Sep 12, 2022 | 9.8 | 31 | NO | NO |
CVE-2022-36730CRITICAL Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at /librarian/delete.php. | Aug 30, 2022 | 9.8 | 31 | NO | NO |
CVE-2022-36712CRITICAL Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /staff/studentdetails.php. | Aug 30, 2022 | 9.8 | 31 | NO | NO |
CVE-2022-36711CRITICAL Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /staff/bookdetails.php. | Aug 30, 2022 | 9.8 | 31 | NO | NO |
CVE-2018-18796CRITICAL Library Management System 1.0 has SQL Injection via the "Search for Books" screen. | Nov 16, 2018 | 9.8 | 31 | NO | NO |
CVE-2022-36734CRITICAL Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the RollNo parameter at /admin/delstu.php. | Aug 30, 2022 | 9.8 | 30 | NO | NO |
CVE-2022-36733CRITICAL Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the M_Id parameter at /admin/del.php. | Aug 30, 2022 | 9.8 | 30 | NO | NO |
CVE-2022-36732CRITICAL Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /librarian/dele.php. | Aug 30, 2022 | 9.8 | 30 | NO | NO |
CVE-2022-36731CRITICAL Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the RollNo parameter at /librarian/delstu.php. | Aug 30, 2022 | 9.8 | 30 | NO | NO |
CVE-2022-36714CRITICAL Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Section parameter at /staff/lab.php. | Aug 30, 2022 | 9.8 | 30 | NO | NO |
Signals from CVEs in this vendor scope (34 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Library Management System Project.
Media articles that mention a CVE ID that affects a product developed by Library Management System Project — matched by CVE ID, not by vendor name.