CVE-2025-9053

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability has been found in projectworlds Travel Management System 1.0. This vulnerability affects unknown code of the file /updatesubcategory.php. The manipulation of the argument t1/s1 leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
projectworlds	Travel Management System	1.0

References

https://github.com/guoma-book/CVE/issues/9Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.320272Permissions Required, VDB Entry
https://vuldb.com/?id.320272Third Party Advisory, VDB Entry
https://vuldb.com/?submit.632023Third Party Advisory, VDB Entry
https://vuldb.com/?submit.632024Third Party Advisory, VDB Entry

Timeline

Published: Aug 15, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-90549.8The MultiLoca - WooCommerce Multi Locations Inventory Management plugin for WordPress is vulnerable to unauthorized modification of data tha CVE-2025-90556.4The VAPIX Edge storage API that allowed a privilege escalation, enabling a VAPIX administrator-privileged user to gain Linux Root privileges CVE-2025-90565.3Unprotected service in the AudioLink component allows a local attacker to overwrite system files via unauthorized service invocation.CVE-2025-90576.4The Biagiotti Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 2.1.3 CVE-2025-90586.4The Mikado Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.5.2 due CVE-2025-90598.8The Altiris Core Agent Updater package (AeXNSC.exe) is prone to an elevation of privileges vulnerability through DLL hijacking.CVE-2025-90609.1A vulnerability has been found in the MSoft MFlash application that allows execution of arbitrary code on the server. The issue occurs i CVE-2025-90616.4The Wilmer Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 2.4.5 due CVE-2025-90627.3Authorization Bypass Through User-Controlled Key vulnerability in MeCODE Informatics and Engineering Services Ltd. Envanty allows Parameter CVE-2025-90639.8An authentication bypass security issue exists within FactoryTalk View Machine Edition Web Browser ActiveX control. Exploitation of this vu CVE-2025-90649.1A path traversal security issue exists within FactoryTalk View Machine Edition, allowing unauthenticated attackers on the same network as th CVE-2025-90658.8A server-side request forgery security issue exists within Rockwell Automation ThinManager® software due to the lack of input sanitization.