CVE-2026-36387
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A Remote Code Execution vulnerability was found in CODEASTRO Membership Management System v1.0 in /add_members.php. Improper file sanitization allows attackers to inject malicious files, leading to RCE.
Risk Assessment
An attacker can take over the server, steal data, or install malware, compromising confidentiality, integrity, and availability.
Recommendation
Immediately update to the latest version or apply a security patch. Additionally, implement file type validation and restrict upload directory permissions.
Other vulnerabilities in CODEASTRO Membership Management System
See all- CVE-2025-69938Critical
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the parameter membershipType.
- CVE-2025-69937Critical
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edit_type.php endpoint via the Parameter id.
- CVE-2025-69936Critical
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /edit_member.php?id=1.
- CVE-2025-69935Critical
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the report.php and revenue_report.php via the fromDate parameter.
- CVE-2025-69934Critical
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_members.php?id=1.
- CVE-2025-69933Critical
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php?id=1.
- CVE-2025-69931Critical
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_membership.php?id=1.
- CVE-2025-69930Critical
CodeAstro Membership Management System 1.0 is vulnerable to SQL injection in /print_membership_card.php via the id parameter. An attacker can exploit this flaw to execute unauthorized database queries.
Original NVD description (English source)
A Remote Code Execution vulnerability was found in CODEASTRO Membership Management System v1.0 in /add_members.php. This vulnerability affects the file upload functionality, where improper file sanitization allows attackers to inject malicious files which leads RCE.