86
CVEs
2
Critical
1
High
0
KEV
84
PoC
3
Unpatched C/H
0.0%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
1
MEDIUM
10
LOW
73
Monthly CVE Trend
Affected Products (30)
PHP
132
Membership Management System
19
Real Estate Management System
19
Online Classroom
13
Gym Management System
11
Apartment Visitor Management System
9
Human Resource Management System
7
Leave Management System
7
Complaint Management System
6
Student Attendance Management System
5
Internet Banking System
5
House Rental Management System
5
Pos And Inventory Management System
4
Online Job Portal
4
Simple Banking System
4
Online Food Ordering System
3
Simple Online Leave Management System
3
Restaurant Pos System
3
Patient Record Management System
3
Bus Ticket Booking System
3
Simple Inventory System
3
Ecommerce Website
3
Payroll System
3
Car Rental System
2
Ingredients Stock Management System
2
University Management System
2
Food Ordering System
2
Simple Hospital Management System
2
Student Grading System
2
Online Leave Application
2
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-70150 | Missing authentication in CodeAstro Membership Management System 1.0 delete_members.php allows unauthenticated deletion of member records. PoC available. | CRITICAL | 9.8 | 0.3% | 69 |
PoC
No patch
|
| CVE-2025-70149 | SQL injection in CodeAstro Membership Management System 1.0 via ID parameter in print_membership_card.php enables unauthenticated database access. PoC available. | CRITICAL | 9.8 | 0.0% | 69 |
PoC
No patch
|
| CVE-2025-70148 | Missing authentication and authorization in print_membership_card.php in CodeAstro Membership Management System 1.0 allows unauthenticated attackers to access membership card data of arbitrary users via direct requests with a manipulated id parameter, resulting in insecure direct object reference (IDOR). [CVSS 7.5 HIGH] | HIGH | 7.5 | 0.1% | 58 |
PoC
No patch
|
| CVE-2026-77019 | SQL injection in CodeAstro Apartment Visitor Management System 1.0 exposes the unauthenticated password-reset endpoint (/apartment-visitor/forgotpw.php) to remote database manipulation via the `secode` parameter. A publicly available proof-of-concept exploit exists, lowering the bar for exploitation. Affected deployments risk partial database read and write access without any prior authentication, as confirmed by the CVSS 4.0 vector (PR:N, UI:N). No KEV listing exists, and exploitation is expected to remain opportunistic and targeted to organizations running this niche PHP application. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-77020 | SQL injection in CodeAstro Apartment Visitor Management System 1.0 allows remote unauthenticated attackers to manipulate backend database queries through the email parameter of the password-recovery.php script. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special configuration is required, and a public proof-of-concept exploit is available on GitHub, lowering the skill threshold for opportunistic attacks. No active exploitation has been confirmed in CISA KEV at time of analysis, and impact is rated partial across confidentiality, integrity, and availability (VC:L/VI:L/VA:L). | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-14640 | SQL injection in CodeAstro Apartment Visitor Management System 1.0 exposes the login endpoint at /index.php to unauthenticated remote attackers who can manipulate the Username parameter to execute arbitrary SQL queries against the backend database. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero prerequisites for exploitation, and the E:P modifier reflects a publicly available proof-of-concept on GitHub. No CISA KEV listing was found at time of analysis, but the combination of an exposed login surface, no authentication barrier, and live POC code materially elevates practical risk beyond the medium CVSS score of 6.9. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-16765 | SQL injection in CodeAstro Online Classroom 1.0 exposes the admin login endpoint `/OnlineClassroom/loginlinkadmin.php` to unauthenticated remote attackers who can manipulate the `aid` parameter to alter backend SQL queries. The practical impact extends beyond the CVSS 4.0 score of 5.5 because the vulnerable file is the admin authentication gateway, meaning successful exploitation can bypass login controls entirely and expose or manipulate the underlying database. A public proof-of-concept exploit has been disclosed on GitHub; no public exploit identified at time of analysis as a KEV-confirmed active exploitation campaign, though the barrier to exploitation is now minimal. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2025-13280 | A vulnerability was determined in CodeAstro Simple Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2026-11582 | SQL injection in CodeAstro Student Attendance Management System 1.0 allows remote unauthenticated attackers to manipulate the Username parameter at /attendance-php/index.php to inject arbitrary SQL. Publicly available exploit code exists per VulDB reference, raising the practical risk despite the moderate 7.3 CVSS score. No CISA KEV listing and no EPSS score were supplied, so exploitation appears opportunistic against this small-vendor PHP application rather than mass-targeted. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2026-7071 | CodeAstro Online Job Portal 1.0 exposes file and directory information through the /users/user-cvs/ endpoint via remote unauthenticated access, allowing attackers to enumerate and retrieve sensitive resume and user data. The vulnerability has publicly available exploit code and affects all versions of the application via the CPE cpe:2.3:a:codeastro:online_job_portal:*:*:*:*:*:*:*:*. CVSS 5.5 with confirmed public exploit availability and EPSS exploitation probability indicates moderate real-world risk for deployments accessible over the network. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2026-8132 | SQL injection in CodeAstro Leave Management System 1.0 allows remote unauthenticated attackers to manipulate the txt_username parameter in /login.php, enabling database queries to be executed with low confidentiality and integrity impact. Publicly available exploit code exists for this vulnerability, increasing real-world exploitation risk despite the moderate CVSS score of 5.5. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2025-11118 | A vulnerability was identified in CodeAstro Student Grading System 1.0.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2026-77681 | Unrestricted file upload in CodeAstro Online Job Portal 1.0 allows authenticated remote attackers to upload arbitrary files via the Name argument in /users/update-profile.php. Exploitation requires a valid user account, after which an attacker can bypass file type restrictions on profile update functionality. A publicly available proof-of-concept exists per the GitHub reference, though no active exploitation has been confirmed by CISA KEV. The unusually low official CVSS 4.0 score of 2.1 (VC:L/VI:L/VA:L) appears inconsistent with CWE-434 in a PHP application, where unrestricted upload frequently enables server-side code execution - security teams should independently verify the actual upload destination and execution context. | LOW | 2.1 | 0.4% | 31 |
PoC
No patch
|
| CVE-2026-13549 | Authorization bypass in CodeAstro Complaint Management System 1.0 exposes the deletereport endpoint to unauthenticated arbitrary deletion of complaint reports and associated files. The deletereport function in application/controllers/Report.php accepts a caller-supplied report identifier without verifying ownership or authorization, enabling any remote user to delete any report by manipulating that identifier. A public proof-of-concept exploit is available on GitHub; no CISA KEV listing exists at time of analysis, indicating no confirmed widespread active exploitation. | LOW | 2.1 | 0.3% | 31 |
PoC
No patch
|
| CVE-2026-13535 | SQL injection in CodeAstro Human Resource Management System 1.0 allows low-privileged remote attackers to manipulate database queries via the ID argument passed to the GetFileInfo function within the View Endpoint. The vulnerability resides in hrsystem/application/models/Employee_model.php and can result in unauthorized read and write access to the underlying database. A public exploit has been published on GitHub, elevating practical risk despite the authentication requirement and moderate CVSS 4.0 score of 5.3. | LOW | 2.1 | 0.2% | 31 |
PoC
No patch
|