CVE-2026-55740 is an SQL injection vulnerability in the Nur-Alam39 bus-ticket application. The issue exists in bus_info.php where the busid parameter received via HTTP POST is concatenated directly into a numeric MySQL query without any input sanitization or parameterization. This improper neutralization of special elements in SQL commands (CWE-89) allows unauthenticated attackers to execute arbitrary SQL commands, potentially leading to full database compromise. The vulnerability has a CVSS 3.1 base score of 9.8, indicating critical severity. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability can lead to unauthorized disclosure, modification, or deletion of data within the backend database. Because the vulnerability is unauthenticated and remotely exploitable over the network, it poses a critical risk to the confidentiality, integrity, and availability of the affected system's data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to implement input validation and parameterized queries to prevent SQL injection. Restricting access to the vulnerable endpoint and monitoring for suspicious activity may also help reduce risk.