CVE-2025-69936
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /edit_member.php?id=1.
Risk Assessment
An attacker can edit member data without authorization, compromising data confidentiality and integrity.
Recommendation
Use prepared SQL statements in edit_member.php and restrict access to this file to authorized users only.
Other vulnerabilities in CodeAstro Membership Management System
See all- CVE-2025-69938Critical
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the parameter membershipType.
- CVE-2025-69937Critical
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edit_type.php endpoint via the Parameter id.
- CVE-2025-69935Critical
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the report.php and revenue_report.php via the fromDate parameter.
- CVE-2025-69934Critical
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_members.php?id=1.
- CVE-2025-69933Critical
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php?id=1.
- CVE-2025-69931Critical
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_membership.php?id=1.
- CVE-2025-69930Critical
CodeAstro Membership Management System 1.0 is vulnerable to SQL injection in /print_membership_card.php via the id parameter. An attacker can exploit this flaw to execute unauthorized database queries.
- CVE-2026-36387Medium
A Remote Code Execution vulnerability was found in CODEASTRO Membership Management System v1.0 in /add_members.php. Improper file sanitization allows attackers to inject malicious files, leading to RCE.
Original NVD description (English source)
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /edit_member.php?id=1.