CVE-2025-69937
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edit_type.php endpoint via the Parameter id.
Risk Assessment
An attacker can modify membership types, potentially leading to privilege escalation or data breach.
Recommendation
Use parameterized SQL queries in edit_type.php and verify permissions before editing types.
Other vulnerabilities in CodeAstro Membership Management System
See all- CVE-2025-69938Critical
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the parameter membershipType.
- CVE-2025-69936Critical
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /edit_member.php?id=1.
- CVE-2025-69935Critical
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the report.php and revenue_report.php via the fromDate parameter.
- CVE-2025-69934Critical
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_members.php?id=1.
- CVE-2025-69933Critical
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php?id=1.
- CVE-2025-69931Critical
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_membership.php?id=1.
- CVE-2025-69930Critical
CodeAstro Membership Management System 1.0 is vulnerable to SQL injection in /print_membership_card.php via the id parameter. An attacker can exploit this flaw to execute unauthorized database queries.
- CVE-2026-36387Medium
A Remote Code Execution vulnerability was found in CODEASTRO Membership Management System v1.0 in /add_members.php. Improper file sanitization allows attackers to inject malicious files, leading to RCE.
Original NVD description (English source)
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edit_type.php endpoint via the Parameter id.