CVE-2025-25777

8.0 highEPSS 0.3%

High (8.0) in codeastro bus ticket booking system. EPSS 0.3% chance of exploitation in the next 30 days.

Insecure Direct Object Reference (IDOR) in Codeastro Bus Ticket Booking System v1.0 allows unauthorized access to user profiles. By manipulating the user ID in the URL, an attacker can access another user's profile without proper authentication or authorization checks.

Severity

CVSS 3.1

8.0 high

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 18% of CVEs (scores of 2026-10-31)
CWE: CWE-639
Published: 2025-04-24
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

codeastro:bus_ticket_booking_system

References

https://codeastro.com/bus-ticket-booking-system-in-php-codeigniter-with-source-code/
https://github.com/arunmodi/Vulnerability-Research/tree/main/CVE-2025-25777

Check your stack JSON