Vulnerability · Published Nov 23, 2025 · Assigned by VulDB

CVE-2025-13546ashraf-kabir travel-agency Search results.php sql injection

Medium 6.3

In plain English

A medium-severity SQL injection in travel-agency from ashraf-kabir. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.4%top 66.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in ashraf-kabir travel-agency up to 1f25aa03544bc5fb7a9e846f8a7879cecdb0cad3. Affected by this issue is some unknown functionality of the file /results.php of the component Search. The manipulation of the argument user_query results in sql injection. The attack can be launched remotely. The exploit is now public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.

Affected products (as reported)

Vendor	Product	Versions
ashraf-kabir	travel-agency	1f25aa03544bc5fb7a9e846f8a7879cecdb0cad3

Weakness: CWE-89, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-333313 | ashraf-kabir travel-agency Search results.php sql injection vdb-entry, technical-description
VDB-333313 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #691466 | travel-agency web 1 SQL Injection vulnerability third-party-advisory
https://github.com/www223-ai/CVE/blob/main/travel-sql2.docx exploit