165
CVEs
8
Critical
22
High
0
KEV
156
PoC
30
Unpatched C/H
0.0%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
8
HIGH
22
MEDIUM
47
LOW
88
Monthly CVE Trend
Affected Products (30)
PHP
132
Membership Management System
19
Real Estate Management System
19
Online Classroom
13
Gym Management System
11
Apartment Visitor Management System
9
Human Resource Management System
7
Leave Management System
7
Complaint Management System
6
Student Attendance Management System
5
Internet Banking System
5
House Rental Management System
5
Pos And Inventory Management System
4
Online Job Portal
4
Simple Banking System
4
Online Food Ordering System
3
Simple Online Leave Management System
3
Restaurant Pos System
3
Patient Record Management System
3
Bus Ticket Booking System
3
Simple Inventory System
3
Ecommerce Website
3
Payroll System
3
Car Rental System
2
Ingredients Stock Management System
2
University Management System
2
Food Ordering System
2
Simple Hospital Management System
2
Student Grading System
2
Online Leave Application
2
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-70150 | Missing authentication in CodeAstro Membership Management System 1.0 delete_members.php allows unauthenticated deletion of member records. PoC available. | CRITICAL | 9.8 | 0.3% | 69 |
PoC
No patch
|
| CVE-2025-25775 | Codeastro Bus Ticket Booking System v1.0 is vulnerable to SQL injection via the kodetiket parameter in /BusTicket-CI/tiket/cekorder. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 0.3% | 69 |
PoC
No patch
|
| CVE-2025-70149 | SQL injection in CodeAstro Membership Management System 1.0 via ID parameter in print_membership_card.php enables unauthenticated database access. PoC available. | CRITICAL | 9.8 | 0.0% | 69 |
PoC
No patch
|
| CVE-2024-2351 | A vulnerability classified as critical was found in CodeAstro Ecommerce Site 1.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 0.7% | 69 |
PoC
No patch
|
| CVE-2024-55509 | SQL injection vulnerability in CodeAstro Complaint Management System v.1.0 allows a remote attacker to execute arbitrary code and escalate privileges via the id parameter of the delete.php component. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 0.8% | 69 |
PoC
No patch
|
| CVE-2025-29017 | A Remote Code Execution (RCE) vulnerability exists in Code Astro Internet Banking System 2.0.0 due to improper file upload validation in the profile_pic parameter within pages_view_client.php. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 2.0% | 66 |
PoC
No patch
|
| CVE-2024-25867 | A SQL Injection vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary SQL commands via the membershipType and membershipAmount parameters. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.1 | 0.7% | 66 |
PoC
No patch
|
| CVE-2023-6773 | A vulnerability has been found in CodeAstro POS and Inventory Management System 1.0 and classified as problematic. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 0.7% | 64 |
PoC
No patch
|
| CVE-2024-25866 | A SQL Injection vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary SQL commands via the email parameter in the index.php component. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 0.8% | 64 |
PoC
No patch
|
| CVE-2024-25869 | An Unrestricted File Upload vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary code via upload of a crafted php file in the. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 18.7% | 64 |
PoC
No patch
|
| CVE-2024-55506 | An IDOR vulnerability in CodeAstro's Complaint Management System v1.0 (version with 0 updates) enables an attacker to execute arbitrary code and obtain sensitive information via the delete.php file. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 0.7% | 64 |
PoC
No patch
|
| CVE-2024-46472 | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection via the parameter 'email' in the Login Page. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.6 | 0.4% | 63 |
PoC
No patch
|
| CVE-2025-25777 | Insecure Direct Object Reference (IDOR) in Codeastro Bus Ticket Booking System v1.0 allows unauthorized access to user profiles. Rated high severity (CVSS 8.0), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.0 | 0.1% | 60 |
PoC
No patch
|
| CVE-2025-70148 | Missing authentication and authorization in print_membership_card.php in CodeAstro Membership Management System 1.0 allows unauthenticated attackers to access membership card data of arbitrary users via direct requests with a manipulated id parameter, resulting in insecure direct object reference (IDOR). [CVSS 7.5 HIGH] | HIGH | 7.5 | 0.1% | 58 |
PoC
No patch
|
| CVE-2024-0543 | A vulnerability classified as critical has been found in CodeAstro Real Estate Management System up to 1.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.5 | 0.5% | 58 |
PoC
No patch
|