Which versions of Rail Pass Management System are affected by CVE-2025-5975?

CVE-2025-5975 presents moderate security risk, a cross-site scripting vulnerability rated CVSS 4.3. Attackers could inject scripts to steal sessions or perform actions as authenticated users.

Is there a public PoC exploit available for CVE-2025-5975?

Yes, a public proof-of-concept exploit is available for CVE-2025-5975. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-5975?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Rail Pass Management System CVE-2025-5975

Q: What is the CVSS score of CVE-2025-5975?

CVE-2025-5975 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-17807 LOW

Cross-site Scripting (XSS) (CWE-79)

2025-06-10 cna@vuldb.com

PHP XSS Rail Pass Management System Phpgurukul

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

AV:N, AC:L, PR:N, UI:R, impact only integrity low

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

4.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

Mar 14, 2026 - 19:49 euvd

EUVD-2025-17807

Analysis Generated

Mar 14, 2026 - 19:49 vuln.today

PoC Detected

Jun 17, 2025 - 20:34 vuln.today

Public exploit code

CVE Published

Jun 10, 2025 - 20:15 cve.org

LOW 2.1

CVE Published

Jun 10, 2025 - 20:15 nvd

MEDIUM 4.3

DescriptionCVE.org

A vulnerability, which was classified as problematic, was found in PHPGurukul Rail Pass Management System 1.0. This affects an unknown part of the file /rpms/download-pass.php. The manipulation of the argument searchdata leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Cross-site scripting (XSS) in PHPGurukul Rail Pass Management System 1.0 allows remote attackers to inject arbitrary web scripts via the searchdata parameter in /rpms/download-pass.php. The vulnerability is publicly exploited with a disclosed proof-of-concept, though EPSS score is low (0.07%), indicating limited active exploitation.

Technical ContextAI

The vulnerability is a reflected XSS (CWE-79) in a PHP-based web application. The affected file /rpms/download-pass.php processes user input from the searchdata argument without proper sanitization, allowing injection of malicious scripts. The CPE confirms the product is Rail Pass Management System version 1.0 from PHPGurukul.

RemediationAI

No official patch has been released by the vendor. As a workaround, sanitize and validate the searchdata parameter in /rpms/download-pass.php to prevent script injection. Alternatively, disable the download-pass.php functionality if not required. Monitor vendor updates for a future fix.