A vulnerability, which was classified as critical, was found in itsourcecode Online Tour and Travel Management System 1.0. This vulnerability affects unknown code of the file /admin/operations/travellers.php. The manipulation of the argument photo results in unrestricted upload.
This vulnerability is reported as CVE-2025-9153. The attack can be launched remotely. Moreover, an exploit is present.
