CVE-2025-63450
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Car-Booking-System-PHP v1.0 is vulnerable to Cross Site Scripting (XSS) in /carlux/booking.php. The vulnerability allows injection of malicious script that may execute in the user's browser.
Risk Assessment
An attacker could execute arbitrary JavaScript in the victim's browser session context, potentially leading to session data theft or actions on behalf of the user. The risk affects users of the booking system.
Recommendation
Implement proper input filtering and encoding in booking.php and other entry points. Consider updating or replacing the vulnerable application.
Other vulnerabilities in Car-Booking-System-PHP
See all- CVE-2025-63453Critical
Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/contact.php. The vulnerability may allow manipulation of SQL queries.
- CVE-2025-63452Critical
Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/forgot-pass.php. The vulnerability may allow manipulation of SQL queries in the password recovery function.
- CVE-2025-63451Critical
Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/sign-in.php. The vulnerability may allow manipulation of SQL queries during login.
Original NVD description (English source)
Car-Booking-System-PHP v.1.0 is vulnerable to Cross Site Scripting (XSS) in /carlux/booking.php.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS