Gym Management System
by Codeastro
CVEs (49)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-70150 | 0.00 | — | 0.01 | Feb 18, 2026 | CodeAstro Membership Management System 1.0 contains a missing authentication vulnerability in delete_members.php that allows unauthenticated attackers to delete arbitrary member records via the id parameter. | |||
| CVE-2025-70148 | 0.00 | — | 0.00 | Feb 18, 2026 | Missing authentication and authorization in print_membership_card.php in CodeAstro Membership Management System 1.0 allows unauthenticated attackers to access membership card data of arbitrary users via direct requests with a manipulated id parameter, resulting in insecure… | |||
| CVE-2025-70149 | 0.00 | — | 0.00 | Feb 18, 2026 | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in print_membership_card.php via the ID parameter. | |||
| CVE-2025-3998 | 0.00 | — | 0.00 | Apr 28, 2025 | A vulnerability classified as critical was found in CodeAstro Membership Management System 1.0. This vulnerability affects unknown code of the file renew.php?id=6. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has… | |||
| CVE-2024-56889 | 0.00 | — | 0.01 | Feb 6, 2025 | Incorrect access control in the endpoint /admin/m_delete.php of CodeAstro Complaint Management System v1.0 allows unauthorized attackers to arbitrarily delete complaints via modification of the id parameter. | |||
| CVE-2024-55507 | 0.00 | — | 0.01 | Jan 3, 2025 | An issue in CodeAstro Complaint Management System v.1.0 allows a remote attacker to escalate privileges via the delete_e.php component. | |||
| CVE-2024-55509 | 0.00 | — | 0.01 | Dec 20, 2024 | SQL injection vulnerability in CodeAstro Complaint Management System v.1.0 allows a remote attacker to execute arbitrary code and escalate privileges via the id parameter of the delete.php component. | |||
| CVE-2024-55505 | 0.00 | — | 0.01 | Dec 18, 2024 | An issue in CodeAstro Complaint Management System v.1.0 allows a remote attacker to escalate privileges via the mess-view.php component. | |||
| CVE-2024-55506 | 0.00 | — | 0.01 | Dec 18, 2024 | An IDOR vulnerability in CodeAstro's Complaint Management System v1.0 (version with 0 updates) enables an attacker to execute arbitrary code and obtain sensitive information via the delete.php file and modifying the id parameter. | |||
| CVE-2024-48709 | 0.00 | — | 0.00 | Oct 21, 2024 | CodeAstro Membership Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via the membershipType parameter in edit_type.php | |||
| CVE-2024-46236 | 0.00 | — | 0.00 | Oct 21, 2024 | CodeAstro Membership Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via the address parameter in add_members.php and edit_member.php. | |||
| CVE-2024-46472 | 0.00 | — | 0.00 | Sep 27, 2024 | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection via the parameter 'email' in the Login Page. | |||
| CVE-2024-46470 | 0.00 | — | 0.00 | Sep 27, 2024 | Cross Site Scripting vulnerability in CodeAstro Membership Management System 1.0 allows attackers to run malicious JavaScript via the membership_type field in the edit-type.php component. | |||
| CVE-2024-46471 | 0.00 | — | 0.01 | Sep 27, 2024 | The Directory Listing in /uploads/ Folder in CodeAstro Membership Management System 1.0 exposes the structure and contents of directories, potentially revealing sensitive information. | |||
| CVE-2024-2333 | 0.00 | — | 0.01 | Mar 9, 2024 | A vulnerability classified as critical has been found in CodeAstro Membership Management System 1.0. Affected is an unknown function of the file /add_members.php. The manipulation of the argument fullname leads to sql injection. It is possible to launch the attack remotely. The… | |||
| CVE-2024-2149 | 0.00 | — | 0.01 | Mar 3, 2024 | A vulnerability classified as critical was found in CodeAstro Membership Management System 1.0. This vulnerability affects unknown code of the file settings.php. The manipulation of the argument currency leads to sql injection. The attack can be initiated remotely. The exploit… | |||
| CVE-2024-25868 | 0.00 | — | 0.01 | Feb 28, 2024 | A Cross Site Scripting (XSS) vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary code via the membershipType parameter in the add_type.php component. | |||
| CVE-2024-25867 | 0.00 | — | 0.01 | Feb 28, 2024 | A SQL Injection vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary SQL commands via the membershipType and membershipAmount parameters in the add_type.php component. | |||
| CVE-2024-25866 | 0.00 | — | 0.01 | Feb 28, 2024 | A SQL Injection vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary SQL commands via the email parameter in the index.php component. | |||
| CVE-2024-1924 | 0.00 | — | 0.00 | Feb 27, 2024 | A vulnerability was found in CodeAstro Membership Management System 1.0. It has been classified as critical. This affects an unknown part of the file /get_membership_amount.php. The manipulation of the argument membershipTypeId leads to sql injection. It is possible to initiate… |
- CVE-2025-70150Feb 18, 2026risk 0.00cvss —epss 0.01
CodeAstro Membership Management System 1.0 contains a missing authentication vulnerability in delete_members.php that allows unauthenticated attackers to delete arbitrary member records via the id parameter.
- CVE-2025-70148Feb 18, 2026risk 0.00cvss —epss 0.00
Missing authentication and authorization in print_membership_card.php in CodeAstro Membership Management System 1.0 allows unauthenticated attackers to access membership card data of arbitrary users via direct requests with a manipulated id parameter, resulting in insecure…
- CVE-2025-70149Feb 18, 2026risk 0.00cvss —epss 0.00
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in print_membership_card.php via the ID parameter.
- CVE-2025-3998Apr 28, 2025risk 0.00cvss —epss 0.00
A vulnerability classified as critical was found in CodeAstro Membership Management System 1.0. This vulnerability affects unknown code of the file renew.php?id=6. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has…
- CVE-2024-56889Feb 6, 2025risk 0.00cvss —epss 0.01
Incorrect access control in the endpoint /admin/m_delete.php of CodeAstro Complaint Management System v1.0 allows unauthorized attackers to arbitrarily delete complaints via modification of the id parameter.
- CVE-2024-55507Jan 3, 2025risk 0.00cvss —epss 0.01
An issue in CodeAstro Complaint Management System v.1.0 allows a remote attacker to escalate privileges via the delete_e.php component.
- CVE-2024-55509Dec 20, 2024risk 0.00cvss —epss 0.01
SQL injection vulnerability in CodeAstro Complaint Management System v.1.0 allows a remote attacker to execute arbitrary code and escalate privileges via the id parameter of the delete.php component.
- CVE-2024-55505Dec 18, 2024risk 0.00cvss —epss 0.01
An issue in CodeAstro Complaint Management System v.1.0 allows a remote attacker to escalate privileges via the mess-view.php component.
- CVE-2024-55506Dec 18, 2024risk 0.00cvss —epss 0.01
An IDOR vulnerability in CodeAstro's Complaint Management System v1.0 (version with 0 updates) enables an attacker to execute arbitrary code and obtain sensitive information via the delete.php file and modifying the id parameter.
- CVE-2024-48709Oct 21, 2024risk 0.00cvss —epss 0.00
CodeAstro Membership Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via the membershipType parameter in edit_type.php
- CVE-2024-46236Oct 21, 2024risk 0.00cvss —epss 0.00
CodeAstro Membership Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via the address parameter in add_members.php and edit_member.php.
- CVE-2024-46472Sep 27, 2024risk 0.00cvss —epss 0.00
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection via the parameter 'email' in the Login Page.
- CVE-2024-46470Sep 27, 2024risk 0.00cvss —epss 0.00
Cross Site Scripting vulnerability in CodeAstro Membership Management System 1.0 allows attackers to run malicious JavaScript via the membership_type field in the edit-type.php component.
- CVE-2024-46471Sep 27, 2024risk 0.00cvss —epss 0.01
The Directory Listing in /uploads/ Folder in CodeAstro Membership Management System 1.0 exposes the structure and contents of directories, potentially revealing sensitive information.
- CVE-2024-2333Mar 9, 2024risk 0.00cvss —epss 0.01
A vulnerability classified as critical has been found in CodeAstro Membership Management System 1.0. Affected is an unknown function of the file /add_members.php. The manipulation of the argument fullname leads to sql injection. It is possible to launch the attack remotely. The…
- CVE-2024-2149Mar 3, 2024risk 0.00cvss —epss 0.01
A vulnerability classified as critical was found in CodeAstro Membership Management System 1.0. This vulnerability affects unknown code of the file settings.php. The manipulation of the argument currency leads to sql injection. The attack can be initiated remotely. The exploit…
- CVE-2024-25868Feb 28, 2024risk 0.00cvss —epss 0.01
A Cross Site Scripting (XSS) vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary code via the membershipType parameter in the add_type.php component.
- CVE-2024-25867Feb 28, 2024risk 0.00cvss —epss 0.01
A SQL Injection vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary SQL commands via the membershipType and membershipAmount parameters in the add_type.php component.
- CVE-2024-25866Feb 28, 2024risk 0.00cvss —epss 0.01
A SQL Injection vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary SQL commands via the email parameter in the index.php component.
- CVE-2024-1924Feb 27, 2024risk 0.00cvss —epss 0.00
A vulnerability was found in CodeAstro Membership Management System 1.0. It has been classified as critical. This affects an unknown part of the file /get_membership_amount.php. The manipulation of the argument membershipTypeId leads to sql injection. It is possible to initiate…
Page 2 of 3