CVE-2025-4064

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A vulnerability was found in ScriptAndTools Online-Travling-System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/viewenquiry.php. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-266 CWE-284 CWE-862

Affected software

Vendor	Product	Versions
ScriptAndTools	Online-Travling-System	1.0

References

https://vuldb.com/?ctiid.306501Permissions Required, VDB Entry
https://vuldb.com/?id.306501Third Party Advisory, VDB Entry
https://vuldb.com/?submit.559467Third Party Advisory, VDB Entry
https://www.websecurityinsights.my.id/2025/04/script-and-tools-online-travling-system.htmlThird Party Advisory

Timeline

Published: Apr 29, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-406405.4Stored Cross-Site Scripting (XSS) vulnerability in Energy CRM v2025 by Status Tracker Ltd, consisting of a stored XSS due to lack of proper CVE-2025-406415.1Cross-site Scripting (XSS) vulnerability stored in Multi-Purpose Inventory Management System, consisting of a stored XSS due to lack of prop CVE-2025-406425.1Reflected Cross-Site Scripting (XSS) vulnerability in WebWork, which allows remote attackers to execute arbitrary code through the 'q' and 'CVE-2025-406435.4Stored Cross-Site Scripting (XSS) vulnerability in Energy CRM v2025 by Status Tracker Ltd, consisting of a stored XSS due to lack of proper CVE-2025-406445.1Reflected Cross-Site Scripting (XSS) vulnerability in Riftzilla's QRGen. This vulnerability allows an attavker to execute JavaScript code in CVE-2025-406458.7Exposure of sensitive information in Viday. This vulnerability could allow an unauthenticated attacker to obtain sensitive information about CVE-2025-406465.4Exposure of sensitive information in Viday. This vulnerability could allow an attacker to obtain sensitive information about customers by in CVE-2025-406475.1Stored Cross-Site Scripting (XSS) vulnerability in Issabel v5.0.0, consisting of a stored XSS due to a lack of proper validation of user inp CVE-2025-406484.8Stored Cross-Site Scripting (XSS) vulnerability in Issabel v5.0.0, consisting of a stored XSS due to a lack of proper validation of user inp CVE-2025-406495.1Stored Cross-Site Scripting (XSS) in Biobanking and Biomolecular Resources Negotiator v3.15.2 - European Research Infrastructure (BBMRI-ERIC CVE-2025-40657.5A vulnerability was found in ScriptAndTools Online-Travling-System 1.0. It has been declared as critical. This vulnerability affects unknown CVE-2025-406508.7Insecure Direct Object Reference (IDOR) vulnerability in Clickedu. This vulnerability could allow an attacker to retrieve information about