CVE-2025-9927

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was identified in projectworlds Travel Management System 1.0. The affected element is an unknown function of the file /viewpackage.php. Such manipulation of the argument t1 leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
projectworlds	Travel Management System	1.0

References

https://github.com/JunGu-W/cve/issues/10Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.322329Permissions Required, VDB Entry
https://vuldb.com/?id.322329Third Party Advisory, VDB Entry
https://vuldb.com/?submit.642583Third Party Advisory, VDB Entry

Timeline

Published: Sep 3, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-99289.8A security flaw has been discovered in projectworlds Travel Management System 1.0. The impacted element is an unknown function of the file /CVE-2025-99294.8A weakness has been identified in code-projects Responsive Blog Site 1.0. This affects an unknown function of the file blogs_view.php. Execu CVE-2025-99309.8A security vulnerability has been detected in 1000projects Beauty Parlour Management System 1.0. This impacts an unknown function of the fil CVE-2025-99316.1A vulnerability was detected in Jinher OA 1.0. Affected is an unknown function of the file /jc6/platform/sys/login!changePassWord.action of CVE-2025-99329.8A flaw has been found in PHPGurukul Beauty Parlour Management System 1.1. Affected by this vulnerability is an unknown functionality of the CVE-2025-99339.8A vulnerability has been found in PHPGurukul Beauty Parlour Management System 1.1. Affected by this issue is some unknown functionality of t CVE-2025-99349.8A vulnerability was found in TOTOLINK X5000R 9.1.0cu.2415_B20250515. This affects the function sub_410C34 of the file /cgi-bin/cstecgi.cgi. CVE-2025-99359.8A vulnerability was determined in TOTOLINK N600R 4.3.0cu.7866_B20220506. This vulnerability affects the function sub_4159F8 of the file /web CVE-2025-99364.3A vulnerability was identified in fuyang_lipengjun platform 1.0.0. This issue affects the function AdController of the file /ad/queryAll. Th CVE-2025-99375.4A security flaw has been discovered in elunez eladmin 1.1. Impacted is the function deleteFile of the component LocalStorageController. The CVE-2025-99388.8A weakness has been identified in D-Link DI-8400 16.07.26A1. The affected element is the function yyxz_dlink_asp of the file /yyxz.asp. This CVE-2025-99395.4A security vulnerability has been detected in CodeAstro Real Estate Management System 1.0. The impacted element is an unknown function of th