CVE-2025-25776

5.0 mediumEPSS 0.3%

Medium (5.0) in codeastro bus ticket booking system. EPSS 0.3% chance of exploitation in the next 30 days.

Cross-Site Scripting (XSS) vulnerability exists in the User Registration and User Profile features of Codeastro Bus Ticket Booking System v1.0 allows an attacker to execute arbitrary code into the Full Name and Address fields during user registration or profile editing.

Severity

CVSS 3.1

5.0 medium

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 17% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2025-04-28
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

codeastro:bus_ticket_booking_system

References

https://codeastro.com/bus-ticket-booking-system-in-php-codeigniter-with-source-code/
https://github.com/arunmodi/Vulnerability-Research/tree/main/CVE-2025-25776

Check your stack JSON