MEDIUM🇵🇱 Wersja polska

CVE-2025-9926

CVSS 5.5v4.0pub. 2025-09-03upd. 2026-04-29

A vulnerability was determined in projectworlds Travel Management System 1.0. Impacted is an unknown function of the file /viewsubcategory.php. This manipulation of the argument t1 causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Projectworlds Travel Management System

    APP
    Projectworlds
    1.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
SQLi
CWE
References

Related vulnerabilities

CVE-2024-51327CRITICAL9.8PL ✓same product

SQL Injection w Travel Management System — ominięcie uwierzytelniania

CVE-2020-24203CRITICAL9.8PL ✓same product

RCE przez nieautoryzowany upload pliku w Travel Management System v1.0

CVE-2024-51326HIGH7.5same product

SQL Injection vulnerability in projectworlds Travel management System v.1.0 allows a remote attacker to execut...

CVE-2025-9924MEDIUM5.5same product

A vulnerability has been found in projectworlds Travel Management System 1.0. This vulnerability affects unkno...

CVE-2025-9925MEDIUM5.5same product

A vulnerability was found in projectworlds Travel Management System 1.0. This issue affects some unknown proce...