PatchTheCVE: isic.lk projecthttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2022-30528: SQL Injection vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allohttps://patchthecve.com/cve/CVE-2022-30528.htmlhttps://patchthecve.com/cve/CVE-2022-30528.htmlWed, 17 Jun 2026 04:43:46 +0000CRITICAL 9.8: SQL Injection vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to execute arbitrary commands via the username parameter to /system/user/modules/mod_users/controller.php.CVE-2022-28607: An issue was discovered in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows ahttps://patchthecve.com/cve/CVE-2022-28607.htmlhttps://patchthecve.com/cve/CVE-2022-28607.htmlWed, 17 Jun 2026 04:38:42 +0000HIGH 7.5: An issue was discovered in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to gain sensitive information via the action parameter to /system/user/modules/mod_users/controller.php.CVE-2022-30529: File upload vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allowshttps://patchthecve.com/cve/CVE-2022-30529.htmlhttps://patchthecve.com/cve/CVE-2022-30529.htmlWed, 17 Jun 2026 04:43:47 +0000HIGH 7.2: File upload vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to upload arbitrary files via /system/application/libs/js/tinymce/plugins/filemanager/dialog.php and /system/application/libs/js/tinymce/plugins/filemanager/upload.php.