CVE-2025-25775

The Codeastro Bus Ticket Booking System v1.0 is vulnerable to SQL injection via the kodetiket parameter in the /BusTicket-CI/tiket/cekorder API endpoint. This vulnerability allows for potential exploitation of the database. As of the current documentation, no patched version is available. Remedia...

CVE-2025-25776

A Cross-Site Scripting (XSS) vulnerability exists in the Codeastro Bus Ticket Booking System v1.0 within the User Registration and User Profile features. The root cause is insufficient input validation of the Full Name and Address fields, which allows an attacker to execute arbitrary code during ...

CVE-2025-25777

The Codeastro Bus Ticket Booking System v1.0 is vulnerable to an Insecure Direct Object Reference (IDOR) (CWE-639). The flaw allows an attacker to bypass authentication and authorization checks by manipulating the user ID parameter within the URL, resulting in unauthorized access to other users' ...