VULNERABILITY INTELLIGENCE

CVE-2025-25777

CVSS score8 HIGH
EPSS probability0.27%
CISA KEVNot currently listed
Published2025-04-24
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Description

Insecure Direct Object Reference (IDOR) in Codeastro Bus Ticket Booking System v1.0 allows unauthorized access to user profiles. By manipulating the user ID in the URL, an attacker can access another user's profile without proper authentication or authorization checks.

Weakness classification

  • CWE-639: Authorization Bypass Through User-Controlled Key

Primary references