CVE-2025-2061

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A vulnerability was found in code-projects Online Ticket Reservation System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /passenger.php. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

Vendor	Product	Versions
code-projects	Online Ticket Reservation System	1.0

References

https://code-projects.org/Product
https://github.com/intercpt/XSS1/blob/main/XSS2.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.298816Permissions Required, VDB Entry
https://vuldb.com/?id.298816Third Party Advisory, VDB Entry
https://vuldb.com/?submit.514529Third Party Advisory, VDB Entry

Timeline

Published: Mar 7, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-206114.7Exposure of sensitive information to an unauthorized actor for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow a CVE-2025-206125.5Incorrect execution-assigned permissions for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated us CVE-2025-206133.3Predictable Seed in Pseudo-Random Number Generator (PRNG) in the firmware for some Intel(R) TDX may allow an authenticated user to potential CVE-2025-206146.7External control of file name or path for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may CVE-2025-206156.6The Qardio Arm iOS application exposes sensitive data such as usernames and passwords in a plist file. This allows an attacker to log in to CVE-2025-206165.5Uncontrolled resource consumption for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated user to p CVE-2025-206177.2Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in UD-LT2 firmware Ver.1.00.008_SE a CVE-2025-206187.9Stack-based buffer overflow for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.100 may allow a privileged user to CVE-2025-20629.8A vulnerability classified as critical has been found in projectworlds Life Insurance Management System 1.0. Affected is an unknown function CVE-2025-206207.5SQL Injection vulnerability exists in STEALTHONE D220/D340 provided by Y'S corporation. An attacker who can access the affected product may CVE-2025-206217.5Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly handle posts with attachments co CVE-2025-206223.8Sensitive information uncleared in resource before release for reuse for some Intel(R) NPU Drivers for Windows before version 32.0.100.4023