Online Tours & Travels Management System vulnerabilities

15 known vulnerabilities in Online Tours & Travels Management System from Online Tours And Travels Management System Project. 15 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

15vulnerabilities

1critical

14high

0exploited

7.4average CVSS score

Latest first

9.8 Critical severity
online_tours_and_travels_management_system: Improper Neutralization of Special Elements used in an SQL Command
CVE-2024-48411Oct 15, 2024Online Tours And Travels Management System Project
itsourcecode Online Tours and Travels Management System v1.0 is vulnerable to SQL Injection (SQLI) via a crafted payload to the val-email parameter in forget_password.php.
7.2 High severity
Online Tours And Travels Management System: Unrestricted Upload of File with Dangerous Type
CVE-2022-43050Nov 7, 2022Online Tours And Travels Management System ProjectEPSS 1.25%
Online Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload vulnerability in the component update_profile.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
7.2 High severity
Online Tours & Travels Management System: Unrestricted Upload of File with Dangerous Type
CVE-2022-43061Nov 3, 2022Online Tours And Travels Management System ProjectEPSS 1.24%
Online Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload vulnerability in the component /operations/travellers.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
7.2 High severity
Online Tours & Travels Management System: Unrestricted Upload of File with Dangerous Type
CVE-2022-41537Oct 18, 2022Online Tours And Travels Management System ProjectEPSS 1.42%
Online Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /user_operations/profile.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
7.2 High severity
Online Tours & Travels Management System: Improper Neutralization of Special Elements used in an SQL Command
CVE-2022-41416Oct 14, 2022Online Tours And Travels Management System Project
Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /user/update_booking.php.
7.2 High severity
Online Tours & Travels Management System: Improper Neutralization of Special Elements used in an SQL Command
CVE-2022-40354Sep 27, 2022Online Tours And Travels Management System Project
Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_booking.php.
7.2 High severity
Online Tours & Travels Management System: Improper Neutralization of Special Elements used in an SQL Command
CVE-2022-40352Sep 27, 2022Online Tours And Travels Management System Project
Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_traveller.php.
7.2 High severity
Online Tours & Travels Management System: Improper Neutralization of Special Elements used in an SQL Command
CVE-2022-40099Sep 26, 2022Online Tours And Travels Management System Project
Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_expense_category.php.
7.2 High severity
Online Tours & Travels Management System: Improper Neutralization of Special Elements used in an SQL Command
CVE-2022-40098Sep 26, 2022Online Tours And Travels Management System Project
Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_expense.php.
7.2 High severity
Online Tours And Travels Management System: Improper Neutralization of Special Elements used in an SQL Command
CVE-2022-40097Sep 26, 2022Online Tours And Travels Management System ProjectEPSS 1.1%
Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_currency.php.
7.2 High severity
Online Tours And Travels Management System: Improper Neutralization of Special Elements used in an SQL Command
CVE-2022-40093Sep 23, 2022Online Tours And Travels Management System ProjectEPSS 1.04%
Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /tour/admin/update_tax.php.
7.2 High severity
Online Tours And Travels Management System: Improper Neutralization of Special Elements used in an SQL Command
CVE-2022-40092Sep 23, 2022Online Tours And Travels Management System ProjectEPSS 1.04%
Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /tour/admin/update_payment.php.
7.2 High severity
Online Tours And Travels Management System: Improper Neutralization of Special Elements used in an SQL Command
CVE-2022-40091Sep 23, 2022Online Tours And Travels Management System ProjectEPSS 1.04%
Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /tour/admin/update_packages.php.
7.2 High severity
Online Tours And Travels Management System: Improper Neutralization of Special Elements used in an SQL Command
CVE-2022-35421Aug 2, 2022Online Tours And Travels Management System Project
Online Tours And Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the pname parameter at /admin/operations/packages.php.
7.2 High severity
Online Tours And Travels Management System: Improper Neutralization of Special Elements used in an SQL Command
CVE-2022-32992Jun 15, 2022Online Tours And Travels Management System Project
Online Tours And Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the tname parameter at /admin/operations/tax.php.