CVE-2022-29008

The CVE-2022-29008 entry concerns an insecure direct object reference (IDOR) in Bus Pass Management System v1.0, specifically the viewid parameter. Exploitation could allow an attacker to access sensitive information by bypassing authorization checks on object access. Affected component: Bus Pass...

CVE-2022-36198

CVE-2022-36198 affects Bus Pass Management System 1.0. The vulnerability is multiple SQL injections in endpoints buspassms/admin/view-enquiry.php, buspassms/admin/pass-bwdates-reports-details.php, buspassms/admin/changeimage.php, buspassms/admin/search-pass.php, buspassms/admin/edit-category-deta...

CVE-2022-35156

CVE-2022-35156 affects Bus Pass Management System 1.0. Multiple sources identify a SQL Injection vulnerability reachable via the searchdata parameter at /buspassms/download-pass.php, with CVSS 3.1 base metrics up to 9.8 (CRITICAL) and impact on confidentiality, integrity, and availability. Affect...

CVE-2021-44315

CVE-2021-44315 affects Bus Pass Management System v1.0. The vulnerability is a misconfiguration where Directory Listing/Browsing is enabled on the web server, allowing an attacker to view sensitive files containing user or server information. Impact is information disclosure (partial confidential...

CVE-2022-35155

CVE-2022-35155 concerns the Bus Pass Management System v1.0, where a reflected cross-site scripting (XSS) vulnerability exists in the searchdata parameter. Multiple connected sources confirm the issue: the vulnerability is triggered via user-supplied input echoed into HTML in the response (notabl...

CVE-2021-44317

Bus Pass Management System v1.0 is affected by a Stored Cross-Site Scripting vulnerability in the pagedes and About Us parameters due to lack of input validation/filtering. The root cause is unvalidated user input stored and later reflected to clients, enabling arbitrary JavaScript execution in t...

CVE-2025-3146

CVE-2025-3146 concerns the PHPGurukul Bus Pass Management System v1.0, where an SQL injection is triggered through the viewid parameter in /view-pass-detail.php. Multiple connected sources (CNVD/CNNVD/NVD/CVE records and CVE-list) confirm remote exploitability and public disclosure, giving attack...