CVE-2025-9426: fallo de gravedad media en itsourcecode Online Tour and Travel Management…
itsourcecode Online Tour and Travel Management System package.php sql injection
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.9epss 0.4%
A weakness has been identified in itsourcecode Online Tour and Travel Management System 1.0. This affects an unknown part of the file /package.php. Executing manipulation of the argument subcatid can lead to sql injection. The attack may be performed from a remote location. The exploit has been made available to the public and could be exploited.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Productos afectados
itsourcecode · Online Tour and Travel Management SystemCVEs relacionadas — itsourcecode Online Tour and Travel Management…
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-9154MEDIUMitsourcecode Online Tour and Travel Management System page-login.php sql injectionEPSS 0.6%CVE-2025-9010MEDIUMitsourcecode Online Tour and Travel Management System booking_report.php sql injectionEPSS 0.5%CVE-2025-9009MEDIUMitsourcecode Online Tour and Travel Management System email_setup.php sql injectionEPSS 0.5%CVE-2025-9008MEDIUMitsourcecode Online Tour and Travel Management System sms_setting.php sql injectionEPSS 0.5%CVE-2025-8993MEDIUMitsourcecode Online Tour and Travel Management System expense_report.php sql injectionEPSS 0.5%CVE-2025-8984MEDIUMitsourcecode Online Tour and Travel Management System expense_category.php sql injectionEPSS 0.5%