CVE-2025-60306

Critical · CVSS 9.9

Simple Car Rental System — Improper Access Control / Authentication Bypass (Privilege Escalation via Session Forgery)

CVSS: 9.9; nvd
EPSS: —
KEV: No
Class: other; CWE-284, CWE-287

Description

code-projects Simple Car Rental System 1.0 has a permission bypass issue where low privilege users can forge high privilege sessions and perform sensitive operations.

Search profile — drives PoC discovery

Symbols sessionprivilegelow privilegehigh privilegeforged sessionadmin sessionauthentication checkroleuser rolepermission

Keywords CVE-2025-60306Simple Car Rental System 1.0permission bypassprivilege escalationsession forgerycode-projectsauthentication bypasslow privilege userCWE-284CWE-287

Versions: 1.0

Ranked PoCs (1) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

fkie-cad/nvd-json-data-feeds needs review

trickest

★ 0

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

References

https://github.com/Chen1-Boop/CVE/blob/main/CVE-2025-60306.md

Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-06T06:30:39.000Z