CVE-2026-55740

Name of the Vulnerable Software and Affected Versions Nur-Alam39 bus-ticket (affected versions not specified)

Description An unauthenticated SQL injection exists in the 'bus info.php' endpoint. The busid parameter, received via HTTP POST, is concatenated directly into a MySQL query without sanitization, escaping, or parameterization. This allows a remote attacker to inject arbitrary SQL, such as UNION-based payloads, to read data from the bus service database. The impact is increased because the application connects to the database using the MySQL root account with an empty password. The query is executed via the mysqli query() function, which does not support stacked statements.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.