Which versions of Movie Ticketing System are affected by CVE-2025-6890?

Organizations using A vulnerability should be aware of moderate risk from CVE-2025-6890, a injection vulnerability rated CVSS 6.3.

Is there a public PoC exploit available for CVE-2025-6890?

Yes, a public proof-of-concept exploit is available for CVE-2025-6890. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-6890?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

Movie Ticketing System CVE-2025-6890

Q: What is the CVSS score of CVE-2025-6890?

CVE-2025-6890 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-19512 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-30 cna@vuldb.com

PHP SQLi Movie Ticketing System Carmelo

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Low-privileges required, low impact on confidentiality, integrity, and availability, reflecting SQL injection exposure.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

Mar 16, 2026 - 01:25 euvd

EUVD-2025-19512

Analysis Generated

Mar 16, 2026 - 01:25 vuln.today

PoC Detected

Jul 08, 2025 - 14:16 vuln.today

Public exploit code

CVE Published

Jun 30, 2025 - 06:15 cve.org

LOW 2.1

CVE Published

Jun 30, 2025 - 06:15 nvd

MEDIUM 6.3

DescriptionCVE.org

A vulnerability was found in code-projects Movie Ticketing System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /ticketConfirmation.php. The manipulation of the argument Date leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in Movie Ticketing System 1.0 allows remote attackers with low privileges to manipulate the backend database through the Date parameter of the /ticketConfirmation.php endpoint. Exploit code is publicly available, but no active exploitation has been confirmed by CISA KEV. The impact is rated low by CVSS, limiting the risk to data exposure or minor data tampering.

Technical ContextAI

The vulnerability is PHP-based SQL injection (CWE-74: Injection) in the Date parameter of ticketConfirmation.php, caused by improper neutralization of user-supplied input before inclusion in an SQL query. CPE data (cpe:2.3:a:carmelo:movie_ticketing_system:1.0) confirms version 1.0 of the Movie Ticketing System by Carmelo/Code-Projects is affected. The application is a web-based ticketing platform, likely using a relational database backend.

RemediationAI

No vendor-released patch identified at time of analysis. Apply a web application firewall rule to block SQL injection patterns targeting the Date parameter in /ticketConfirmation.php. Disable direct access to the endpoint until a patch is available, or add server-side input sanitization for the Date field. Monitor the vendor site for updates.