https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-9928.htmlhttps://patchthecve.com/cve/CVE-2025-9928.htmlWed, 17 Jun 2026 10:10:05 +0000HIGH 7.3: A security flaw has been discovered in projectworlds Travel Management System 1.0. The impacted element is an unknown function of the file /viewcategory.php. Performing manipulation of the argument t1 results in sql injection. It is possible to initiate the attack remotely. The exploit has been relehttps://patchthecve.com/cve/CVE-2025-9927.htmlhttps://patchthecve.com/cve/CVE-2025-9927.htmlWed, 17 Jun 2026 10:10:05 +0000HIGH 7.3: A vulnerability was identified in projectworlds Travel Management System 1.0. The affected element is an unknown function of the file /viewpackage.php. Such manipulation of the argument t1 leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might behttps://patchthecve.com/cve/CVE-2025-9926.htmlhttps://patchthecve.com/cve/CVE-2025-9926.htmlWed, 17 Jun 2026 10:10:05 +0000HIGH 7.3: A vulnerability was determined in projectworlds Travel Management System 1.0. Impacted is an unknown function of the file /viewsubcategory.php. This manipulation of the argument t1 causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and mahttps://patchthecve.com/cve/CVE-2025-9925.htmlhttps://patchthecve.com/cve/CVE-2025-9925.htmlThu, 01 Oct 2026 16:10:00 +0000HIGH 7.3: A vulnerability was found in projectworlds Travel Management System 1.0. This issue affects some unknown processing of the file /detail.php. The manipulation of the argument pid results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used.https://patchthecve.com/cve/CVE-2025-9924.htmlhttps://patchthecve.com/cve/CVE-2025-9924.htmlWed, 17 Jun 2026 10:10:04 +0000HIGH 7.3: A vulnerability has been found in projectworlds Travel Management System 1.0. This vulnerability affects unknown code of the file /enquiry.php. The manipulation of the argument t2 leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and https://patchthecve.com/cve/CVE-2025-9053.htmlhttps://patchthecve.com/cve/CVE-2025-9053.htmlWed, 17 Jun 2026 10:08:13 +0000HIGH 7.3: A vulnerability has been found in projectworlds Travel Management System 1.0. This vulnerability affects unknown code of the file /updatesubcategory.php. The manipulation of the argument t1/s1 leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public https://patchthecve.com/cve/CVE-2025-9052.htmlhttps://patchthecve.com/cve/CVE-2025-9052.htmlWed, 17 Jun 2026 10:08:13 +0000HIGH 7.3: A vulnerability was identified in projectworlds Travel Management System 1.0. This affects an unknown part of the file /updatepackage.php. The manipulation of the argument s1 leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may https://patchthecve.com/cve/CVE-2025-9051.htmlhttps://patchthecve.com/cve/CVE-2025-9051.htmlWed, 17 Jun 2026 10:08:13 +0000HIGH 7.3: A vulnerability was determined in projectworlds Travel Management System 1.0. Affected by this issue is some unknown functionality of the file /updatecategory.php. The manipulation of the argument t1 leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the phttps://patchthecve.com/cve/CVE-2025-9050.htmlhttps://patchthecve.com/cve/CVE-2025-9050.htmlWed, 17 Jun 2026 10:08:13 +0000HIGH 7.3: A vulnerability was found in projectworlds Travel Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /addcategory.php. The manipulation of the argument t1 leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the pubhttps://patchthecve.com/cve/CVE-2024-12950.htmlhttps://patchthecve.com/cve/CVE-2024-12950.htmlWed, 17 Jun 2026 07:00:50 +0000MEDIUM 6.3: A vulnerability was found in code-projects/projectworlds Travel Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /subcat.php. The manipulation of the argument catid leads to sql injection. The attack may be initiated remotely. The exploit hhttps://patchthecve.com/cve/CVE-2024-12949.htmlhttps://patchthecve.com/cve/CVE-2024-12949.htmlWed, 17 Jun 2026 07:00:49 +0000MEDIUM 6.3: A vulnerability was found in code-projects Travel Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /package.php. The manipulation of the argument subcatid leads to sql injection. The attack can be initiated remotely. The exploit has been dihttps://patchthecve.com/cve/CVE-2024-12948.htmlhttps://patchthecve.com/cve/CVE-2024-12948.htmlWed, 17 Jun 2026 07:00:49 +0000MEDIUM 6.3: A vulnerability was found in code-projects Travel Management System 1.0. It has been classified as critical. This affects an unknown part of the file /detail.php. The manipulation of the argument pid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been discloshttps://patchthecve.com/cve/CVE-2024-51328.htmlhttps://patchthecve.com/cve/CVE-2024-51328.htmlWed, 17 Jun 2026 08:05:36 +0000MEDIUM 6.1: Cross Site Scripting vulnerability in addcategory.php in projectworld's Travel Management System v1.0 allows remote attacker to inject arbitrary code via the t2 parameter.https://patchthecve.com/cve/CVE-2024-51327.htmlhttps://patchthecve.com/cve/CVE-2024-51327.htmlWed, 17 Jun 2026 08:05:36 +0000CRITICAL 9.8: SQL Injection in loginform.php in ProjectWorld's Travel Management System v1.0 allows remote attackers to bypass authentication via SQL Injection in the 'username' and 'password' fields.https://patchthecve.com/cve/CVE-2024-51326.htmlhttps://patchthecve.com/cve/CVE-2024-51326.htmlWed, 17 Jun 2026 08:05:36 +0000HIGH 7.5: SQL Injection vulnerability in projectworlds Travel management System v.1.0 allows a remote attacker to execute arbitrary code via the 't2' parameter in deletesubcategory.php.https://patchthecve.com/cve/CVE-2021-25208.htmlhttps://patchthecve.com/cve/CVE-2021-25208.htmlWed, 17 Jun 2026 03:41:38 +0000CRITICAL 9.8: Arbitrary file upload vulnerability in SourceCodester Travel Management System v 1.0 allows attackers to execute arbitrary code via the file upload to updatepackage.php.https://patchthecve.com/cve/CVE-2021-25213.htmlhttps://patchthecve.com/cve/CVE-2021-25213.htmlWed, 17 Jun 2026 03:41:38 +0000CRITICAL 9.8: SQL injection vulnerability in SourceCodester Travel Management System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the catid parameter to subcat.php.https://patchthecve.com/cve/CVE-2020-29205.htmlhttps://patchthecve.com/cve/CVE-2020-29205.htmlWed, 17 Jun 2026 03:11:08 +0000MEDIUM 6.1: XSS in signup form in Project Worlds Online Examination System 1.0 allows remote attacker to inject arbitrary code via the name fieldhttps://patchthecve.com/cve/CVE-2020-24203.htmlhttps://patchthecve.com/cve/CVE-2020-24203.htmlWed, 17 Jun 2026 03:05:18 +0000CRITICAL 9.8: Insecure File Permissions and Arbitrary File Upload in the upload pic function in updatesubcategory.php in Projects World Travel Management System v1.0 allows remote unauthenticated attackers to gain remote code execution.