https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-13247.htmlhttps://patchthecve.com/cve/CVE-2025-13247.htmlWed, 07 Oct 2026 21:10:00 +0000HIGH 7.3: A security flaw has been discovered in PHPGurukul Tourism Management System 1.0. The affected element is an unknown function of the file /admin/user-bookings.php. The manipulation of the argument uid results in sql injection. It is possible to launch the attack remotely. The exploit has been releasehttps://patchthecve.com/cve/CVE-2025-57642.htmlhttps://patchthecve.com/cve/CVE-2025-57642.htmlWed, 17 Jun 2026 09:43:16 +0000HIGH 7.2: A Shell Upload vulnerability in Tourism Management System 2.0 allows an attacker to upload and execute arbitrary PHP shell scripts on the server, leading to remote code execution and unauthorized access to the system. This can result in the compromise of sensitive data and system functionality.https://patchthecve.com/cve/CVE-2025-4890.htmlhttps://patchthecve.com/cve/CVE-2025-4890.htmlWed, 17 Jun 2026 09:34:14 +0000MEDIUM 5.3: A vulnerability was found in code-projects Tourism Management System 1.0 and classified as critical. This issue affects the function LoginUser of the component Login User. The manipulation of the argument username/password leads to stack-based buffer overflow. Attacking locally is a requirement. Thehttps://patchthecve.com/cve/CVE-2025-4889.htmlhttps://patchthecve.com/cve/CVE-2025-4889.htmlWed, 17 Jun 2026 09:34:14 +0000MEDIUM 5.3: A vulnerability has been found in code-projects Tourism Management System 1.0 and classified as critical. This vulnerability affects the function AddUser of the component User Registration. The manipulation of the argument username/password leads to buffer overflow. Local access is required to approhttps://patchthecve.com/cve/CVE-2025-0538.htmlhttps://patchthecve.com/cve/CVE-2025-0538.htmlWed, 17 Jun 2026 08:26:40 +0000LOW 3.5: A vulnerability, which was classified as problematic, was found in code-projects Tourism Management System 1.0. Affected is an unknown function of the file /admin/manage-pages.php. The manipulation of the argument pgedetails leads to cross site scripting. It is possible to launch the attack remotelyhttps://patchthecve.com/cve/CVE-2024-41333.htmlhttps://patchthecve.com/cve/CVE-2024-41333.htmlWed, 17 Jun 2026 07:47:35 +0000MEDIUM 6.1: A reflected cross-site scripting (XSS) vulnerability in Phpgurukul Tourism Management System v2.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload into the uname parameter.https://patchthecve.com/cve/CVE-2024-32256.htmlhttps://patchthecve.com/cve/CVE-2024-32256.htmlWed, 17 Jun 2026 07:29:25 +0000HIGH 8.1: Phpgurukul Tourism Management System v2.0 is vulnerable to Unrestricted Upload of File with Dangerous Type via /tms/admin/change-image.php. When updating a current package, there are no checks for what types of files are uploaded from the image.https://patchthecve.com/cve/CVE-2024-32254.htmlhttps://patchthecve.com/cve/CVE-2024-32254.htmlWed, 17 Jun 2026 07:29:25 +0000HIGH 8.8: Phpgurukul Tourism Management System v2.0 is vulnerable to Unrestricted Upload of File with Dangerous Type via tms/admin/create-package.php. When creating a new package, there is no checks for what types of files are uploaded from the image.