CodeAstro vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2025-70150 CodeAstro Membership Management System 1.0 contains a missing authentication vulnerability in delete_members.php that allows unauthenticated attackers to deleteCritical 9.8 · Feb 18, 2026
• CVE-2025-70148 Missing authentication and authorization in print_membership_card.php in CodeAstro Membership Management System 1.0 allows unauthenticated attackers to access mHigh 7.5 · Feb 18, 2026
• CVE-2025-70149 CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in print_membership_card.php via the ID parameter.Critical 9.8 · Feb 18, 2026
• CVE-2025-25775 Codeastro Bus Ticket Booking System v1.0 is vulnerable to SQL injection via the kodetiket parameter in /BusTicket-CI/tiket/cekorder.Critical 9.8 · Apr 25, 2025
• CVE-2025-25777 Insecure Direct Object Reference (IDOR) in Codeastro Bus Ticket Booking System v1.0 allows unauthorized access to user profiles.High 8 · Apr 24, 2025
• CVE-2025-29017 A Remote Code Execution (RCE) vulnerability exists in Code Astro Internet Banking System 2.0.0 due to improper file upload validation in the profile_pic parametHigh 8.8 · Apr 10, 2025
• CVE-2024-56889 Incorrect access control in the endpoint /admin/m_delete.php of CodeAstro Complaint Management System v1.0 allows unauthorized attackers to arbitrarily delete cHigh 7.5 · Feb 6, 2025
• CVE-2024-56924 A Cross Site Request Forgery (CSRF) vulnerability in Code Astro Internet banking system 2.0.0 allows remote attackers to execute arbitrary JavaScript on the admHigh 7.3 · Jan 22, 2025
• CVE-2024-55507 An issue in CodeAstro Complaint Management System v.1.0 allows a remote attacker to escalate privileges via the delete_e.php component.Critical 9.8 · Jan 3, 2025
• CVE-2024-55509 SQL injection vulnerability in CodeAstro Complaint Management System v.1.0 allows a remote attacker to execute arbitrary code and escalate privileges via the idCritical 9.8 · Dec 20, 2024
• CVE-2024-55506 An IDOR vulnerability in CodeAstro's Complaint Management System v1.0 (version with 0 updates) enables an attacker to execute arbitrary code and obtain sensitivHigh 8.8 · Dec 18, 2024
• CVE-2024-55505 An issue in CodeAstro Complaint Management System v.1.0 allows a remote attacker to escalate privileges via the mess-view.php component.High 8.8 · Dec 18, 2024
• CVE-2024-46472 CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection via the parameter 'email' in the Login Page.High 8.6 · Sep 27, 2024
• CVE-2024-46471 The Directory Listing in /uploads/ Folder in CodeAstro Membership Management System 1.0 exposes the structure and contents of directories, potentially revealingHigh 7.5 · Sep 27, 2024
• CVE-2022-46499 Hospital Management System 1.0 was discovered to contain a SQL injection vulnerability via the pat_number parameter at his_admin_view_single_patient.php.High 8.8 · Mar 7, 2024
• CVE-2022-46497 Hospital Management System 1.0 was discovered to contain a SQL injection vulnerability via the pat_number parameter at his_doc_view_single_patien.php.High 8.1 · Mar 7, 2024
• CVE-2024-25869 An Unrestricted File Upload vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary code via upload oHigh 8.8 · Feb 28, 2024
• CVE-2024-25867 A SQL Injection vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary SQL commands via the membershCritical 9.1 · Feb 28, 2024
• CVE-2024-25866 A SQL Injection vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary SQL commands via the email paHigh 8.8 · Feb 28, 2024
• CVE-2024-1824 A vulnerability, which was classified as critical, has been found in CodeAstro House Rental Management System 1.0.High 7.3 · Feb 23, 2024
• CVE-2024-0247 A vulnerability classified as critical was found in CodeAstro Online Food Ordering System 1.0.High 7.3 · Jan 5, 2024
• CVE-2022-43085 An arbitrary file upload vulnerability in add_product.php of Restaurant POS System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.High 7.2 · Nov 1, 2022