Which versions of Rail Pass Management System are affected by CVE-2025-6126?

Organizations using A vulnerability should be aware of moderate risk from CVE-2025-6126, a cross-site scripting vulnerability rated CVSS 4.3.

Is there a public PoC exploit available for CVE-2025-6126?

Yes, a public proof-of-concept exploit is available for CVE-2025-6126. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-6126?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Rail Pass Management System CVE-2025-6126

Q: What is the CVSS score of CVE-2025-6126?

CVE-2025-6126 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-18404 LOW

Cross-site Scripting (XSS) (CWE-79)

2025-06-16 cna@vuldb.com

PHP XSS Rail Pass Management System Phpgurukul

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

AV:N, AC:L, PR:N, UI:R, C:L, I:L, A:N

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

4.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

Mar 14, 2026 - 21:59 euvd

EUVD-2025-18404

Analysis Generated

Mar 14, 2026 - 21:59 vuln.today

PoC Detected

Jun 24, 2025 - 15:56 vuln.today

Public exploit code

CVE Published

Jun 16, 2025 - 15:15 nvd

MEDIUM 4.3

CVE Published

Jun 16, 2025 - 15:15 cve.org

LOW 2.1

DescriptionCVE.org

A vulnerability was found in PHPGurukul Rail Pass Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /contact.php. The manipulation of the argument Name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.

AnalysisAI

Cross-site scripting (XSS) in PHPGurukul Rail Pass Management System 1.0 allows remote attackers to inject arbitrary web scripts via the Name parameter in /contact.php. A public exploit exists, but no active exploitation has been confirmed. The EPSS score is low (0.05%), indicating low exploitation likelihood.

Technical ContextAI

The vulnerability is a stored or reflected cross-site scripting (XSS) issue in a PHP-based web application. The affected component is the contact form (contact.php), where the Name parameter is not properly sanitized before being rendered. CWE-79 describes improper neutralization of input during web page generation. The CPE indicates the exact product and version: Rail Pass Management System 1.0 from PHPGurukul.

RemediationAI

Upgrade to a patched version if available; otherwise, sanitize the Name parameter in /contact.php to prevent XSS. As a workaround, implement input validation and output encoding for all user-supplied data. No official patch has been identified at this time.