CVE-2026-55740 CRITICAL

CVE-2026-55740: SQL Injection in Nur-Alam39 bus-ticket bus_info.php via busid parameter

Vendor Nur-Alam39
Product bus-ticket
Weakness CWE-89 · SQLi
Published June 18, 2026
Last update August 10, 2026
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Nur-Alam39 bus-ticket (no released versions; latest commit 459cabdbeb99c00225b26e46e3c2c30ae1de7bad) contains an unauthenticated SQL injection vulnerability in bus_info.php. The busid parameter received via HTTP POST is concatenated directly into a MySQL query (select * from bus_info where id=) without sanitization, escaping, or parameterization, and in a numeric (unquoted) context.

Key dates

02Disclosure timeline

June 18, 2026 CVE published
August 10, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-2497 Gallery by BestWebSoft <= 4.7.9 - Authenticated (Editor+) SQL Injection via Gallery Image Order Array Keys CVE-2026-65546 WordPress Qode Tours plugin <= 3.1.3.1 - SQL Injection vulnerability CVE-2026-32551 WordPress Woo Essential plugin <= 4.3.0 - SQL Injection vulnerability CVE-2026-28142 WordPress Web Directory Free plugin <= 1.7.13 - SQL Injection vulnerability CVE-2026-65520 WordPress WP OAuth Server plugin <= 6.2.0 - SQL Injection vulnerability