CVE-2025-9052

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was identified in projectworlds Travel Management System 1.0. This affects an unknown part of the file /updatepackage.php. The manipulation of the argument s1 leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
projectworlds	Travel Management System	1.0

References

https://github.com/guoma-book/CVE/issues/8Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.320271Permissions Required, VDB Entry
https://vuldb.com/?id.320271Third Party Advisory, VDB Entry
https://vuldb.com/?submit.632022Third Party Advisory, VDB Entry
https://github.com/guoma-book/CVE/issues/8Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Aug 15, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-90539.8A vulnerability has been found in projectworlds Travel Management System 1.0. This vulnerability affects unknown code of the file /updatesub CVE-2025-90549.8The MultiLoca - WooCommerce Multi Locations Inventory Management plugin for WordPress is vulnerable to unauthorized modification of data tha CVE-2025-90556.4The VAPIX Edge storage API that allowed a privilege escalation, enabling a VAPIX administrator-privileged user to gain Linux Root privileges CVE-2025-90565.3Unprotected service in the AudioLink component allows a local attacker to overwrite system files via unauthorized service invocation.CVE-2025-90576.4The Biagiotti Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 2.1.3 CVE-2025-90586.4The Mikado Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.5.2 due CVE-2025-90598.8The Altiris Core Agent Updater package (AeXNSC.exe) is prone to an elevation of privileges vulnerability through DLL hijacking.CVE-2025-90609.1A vulnerability has been found in the MSoft MFlash application that allows execution of arbitrary code on the server. The issue occurs i CVE-2025-90616.4The Wilmer Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 2.4.5 due CVE-2025-90627.3Authorization Bypass Through User-Controlled Key vulnerability in MeCODE Informatics and Engineering Services Ltd. Envanty allows Parameter CVE-2025-90639.8An authentication bypass security issue exists within FactoryTalk View Machine Edition Web Browser ActiveX control. Exploitation of this vu CVE-2025-90649.1A path traversal security issue exists within FactoryTalk View Machine Edition, allowing unauthenticated attackers on the same network as th