CVE-2025-9928 - projectworlds Travel Management System viewcategory.php sql injection

Back Back to CVE browser

MEDIUM

projectworlds Travel Management System viewcategory.php sql injection

Published Sep 3, 2025

6.9

MEDIUM

CVSS 4.0

EPSS 0.44%

Description

A security flaw has been discovered in projectworlds Travel Management System 1.0. The impacted element is an unknown function of the file /viewcategory.php. Performing manipulation of the argument t1 results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited.

Affected products

Vendor Projectworlds Product Travel Management System Default
n/a
- Version
  1.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Projectworlds

Travel Management System

n/a

Version	Status	Constraints
1.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-74

CWE-89

SQL Injection

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-26639
Advisory
https://github.com/JunGu-W/cve/issues/11
exploitissue-trackingIssue Tracking
https://vuldb.com/?ctiid.322330
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.322330
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.642587
third-party-advisoryThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-26639		Advisory
https://github.com/JunGu-W/cve/issues/11		exploitissue-trackingIssue Tracking
https://vuldb.com/?ctiid.322330		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.322330		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.642587		third-party-advisoryThird Party AdvisoryVDB Entry