CVE-2025-9009: medium-severity vulnerability in itsourcecode Online Tour and Travel Management…
itsourcecode Online Tour and Travel Management System email_setup.php sql injection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.9epss 0.4%
A vulnerability has been found in itsourcecode Online Tour and Travel Management System 1.0. Affected is an unknown function of the file /admin/email_setup.php. The manipulation of the argument Name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
itsourcecode · Online Tour and Travel Management SystemRelated CVEs — itsourcecode Online Tour and Travel Management…
In the same product, most dangerous first.
CVE-2025-9154MEDIUMitsourcecode Online Tour and Travel Management System page-login.php sql injectionEPSS 0.6%CVE-2025-9153MEDIUMitsourcecode Online Tour and Travel Management System travellers.php unrestricted uploadEPSS 0.5%CVE-2025-9426MEDIUMitsourcecode Online Tour and Travel Management System package.php sql injectionEPSS 0.4%CVE-2025-9425MEDIUMitsourcecode Online Tour and Travel Management System enquiry.php sql injectionEPSS 0.4%CVE-2025-9010MEDIUMitsourcecode Online Tour and Travel Management System booking_report.php sql injectionEPSS 0.4%CVE-2025-9008MEDIUMitsourcecode Online Tour and Travel Management System sms_setting.php sql injectionEPSS 0.4%