Phpgurukul Bus Pass Management System vulnerabilities

7 CVEs affecting Phpgurukul Bus Pass Management System, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-3146, published 2025-04-03.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-35155, published 2022-09-30. Medium severity, CVSS 6.1. EPSS: 2.6% chance of exploitation in the next 30 days. Bus Pass Management System v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the searchdata parameter.
CVE-2021-44315, published 2021-12-16. High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days. In Bus Pass Management System v1.0, Directory Listing/Browsing is enabled on the web server which allows an attacker to view the sensitive files of the application, for example: Any file which…
CVE-2022-35156, published 2022-09-30. Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days. Bus Pass Management System 1.0 was discovered to contain a SQL Injection vulnerability via the searchdata parameter at /buspassms/download-pass.php..
CVE-2022-29008, published 2022-05-11. Medium severity, CVSS 6.5. EPSS: 1.3% chance of exploitation in the next 30 days. An insecure direct object reference (IDOR) vulnerability in the viewid parameter of Bus Pass Management System v1.0 allows attackers to access sensitive information.
CVE-2022-36198, published 2022-08-22. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. Multiple SQL injections detected in Bus Pass Management System 1.0 via buspassms/admin/view-enquiry.php, buspassms/admin/pass-bwdates-reports-details.php, buspassms/admin/changeimage.php,…
CVE-2025-3146, published 2025-04-03. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability, which was classified as critical, was found in PHPGurukul Bus Pass Management System 1.0. This affects an unknown part of the file /view-pass-detail.php. The manipulation of the…
CVE-2021-44317, published 2021-12-16. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. In Bus Pass Management System v1.0, parameters 'pagedes' and `About Us` are affected with a Stored Cross-site scripting vulnerability.