Vulnerability · Published Jun 18, 2026 · Assigned by TuranSec

CVE-2026-55740SQL Injection in Nur-Alam39 bus-ticket bus_info.php via busid parameter

Critical 9.8

In plain English

A critical-severity SQL injection in bus-ticket from Nur-Alam39. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.3%top 79.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nur-Alam39 bus-ticket (no released versions; latest commit 459cabdbeb99c00225b26e46e3c2c30ae1de7bad) contains an unauthenticated SQL injection vulnerability in bus_info.php. The busid parameter received via HTTP POST is concatenated directly into a MySQL query (select * from bus_info where id=) without sanitization, escaping, or parameterization, and in a numeric (unquoted) context.

Affected products (as reported)

Vendor	Product	Versions
Nur-Alam39	bus-ticket	0

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Vulnerable code: bus_info.php (busid concatenated into SQL) technical-description
https://github.com/Nur-Alam39/bus-ticket product