CVE-2024-42761

A Stored Cross Site Scripting (XSS) vulnerability exists in the Kashipara Bus Ticket Reservation System v1.0 within the /admin_schedule.php endpoint. The root cause is the lack of effective filtering and escaping of user-supplied data, specifically via the scheduleDurationPHP parameter. Remote at...

CVE-2024-42763

A Reflected Cross Site Scripting (XSS) vulnerability exists in the Kashipara Bus Ticket Reservation System v1.0 within the "/schedule.php" page. The root cause is the lack of effective filtering and escaping of user-supplied data provided via the "bookingdate" parameter. A remote attacker can exp...

CVE-2024-42762

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Kashipara Bus Ticket Reservation System v1.0 within the "/history.php" endpoint. The root cause is the lack of effective filtering and escaping of user-supplied data provided in the Name , Phone , and Email parameter fields. Remote a...

CVE-2024-42766

Kashipara Bus Ticket Reservation System v1.0.0 is reported vulnerable to Incorrect Access Control via the /deleteTicket.php endpoint, enabling unauthorized actions such as deleting bookings. The root cause is broken access control; the impact is access/modify/admin actions outside the intended pe...

CVE-2024-42765

The Kashipara Bus Ticket Reservation System v1.0 is vulnerable to a SQL injection vulnerability in the /login.php page. The root cause is the application's failure to properly validate externally-entered SQL statements, specifically via the "email" or "password" parameters. This allows remote att...

CVE-2024-42764

The Kashipara Bus Ticket Reservation System v1.0 is vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability via the /deleteTicket.php endpoint. The root cause is the failure of the system to adequately verify that requests originate from a trusted user. An attacker can exploit this by for...