CVE-2025-9154 MEDIUM

CVE-2025-9154: itsourcecode Online Tour and Travel Management System page-login.php sql injection

Vendor Itsourcecode
Product Online Tour and Travel Management System
Weakness CWE-89 · SQLi
Published August 19, 2025
Last update August 19, 2025
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A flaw has been found in itsourcecode Online Tour and Travel Management System 1.0. This issue affects some unknown processing of the file /user/page-login.php. This manipulation of the argument email causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.

Key dates

02Disclosure timeline

August 19, 2025 CVE published
August 19, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-2064 projectworlds Life Insurance Management System deletePayment.php sql injection CVE-2024-11958 SQL Injection in run-llama/llama_index CVE-2025-6333 PHPGurukul Directory Management System admin-profile.php sql injection CVE-2024-6265 UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress <= 1.2.10 - Unauthenticated SQL Injection via 'uwp_sort_by' CVE-2025-9759 Campcodes/SourceCodester Courier Management System ajax.php signup sql injection