CVE-2026-55740
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Nur-Alam39 bus-ticket (no released versions; latest commit 459cabdbeb99c00225b26e46e3c2c30ae1de7bad) contains an unauthenticated SQL injection vulnerability in bus_info.php. The busid parameter received via HTTP POST is concatenated directly into a MySQL query (select * from bus_info where id=) without sanitization, escaping, or parameterization, and in a numeric (unquoted) context.
Risk Assessment
An attacker can manipulate SQL queries, potentially leading to data leakage, modification, or deletion, and possibly full application compromise.
Recommendation
Immediately use parameterized queries or an ORM. Also stop using the application until it is fixed.
Original NVD description (English source)
Nur-Alam39 bus-ticket (no released versions; latest commit 459cabdbeb99c00225b26e46e3c2c30ae1de7bad) contains an unauthenticated SQL injection vulnerability in bus_info.php. The busid parameter received via HTTP POST is concatenated directly into a MySQL query (select * from bus_info where id=) without sanitization, escaping, or parameterization, and in a numeric (unquoted) context.