CVE-2025-60306: code-projects simple_car_rental_system Improper Access Control

Vulnerability summary

CVE-2025-60306 is a critical (CVSS 9.9) Improper Access Control vulnerability in code-projects simple_car_rental_system. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 31.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 10-10-2025
   PublishedVulnerability first disclosed.
2. 05-07-2026
   Last modifiedVulnerability information updated.

Description

code-projects Simple Car Rental System 1.0 has a permission bypass issue where low privilege users can forge high privilege sessions and perform sensitive operations.

• CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
• CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.