A vulnerability labeled as critical has been found in itsourcecode Online Tour and Travel Management System 1.0. This affects an unknown part of the file /package.php. Executing manipulation of the argument subcatid can lead to sql injection.
This vulnerability appears as CVE-2025-9426. The attack may be performed from a remote location. In addition, an exploit is available.
