📦

bus_ticket_booking_system

Vendor: codeastro

Login to add this product to WatchStack
Actively Exploited 0 CISA KEV List
PoC / Exploits 0 Code Available
Total RCEs 0 Remote Access
Total CVEs 6 Total Indexed
Avg. EPSS 0.32% Exploit Prob.
Latest CVE CVE-2025-25776 Apr 28

Security Vulnerability Index

Page 1 / 1
5.0 CVSS
CVE-2025-25776

Cross-Site Scripting (XSS) vulnerability exists in the User Registration and User Profile features of Codeastro Bus Ticket Booking System v1.0 allows an attacker to execute arbitrary code into the Full Name and Address fields during user registration or profile editing.

EPSS: 0.23%
9.8 CVSS
CVE-2025-25775

Codeastro Bus Ticket Booking System v1.0 is vulnerable to SQL injection via the kodetiket parameter in /BusTicket-CI/tiket/cekorder.

EPSS: 0.48%
8.0 CVSS
CVE-2025-25777

Insecure Direct Object Reference (IDOR) in Codeastro Bus Ticket Booking System v1.0 allows unauthorized access to user profiles. By manipulating the user ID in the URL, an attacker can access another user's profile without proper authentication or authorization checks.

EPSS: 0.25%