Vulnerabilidades de Codeastro
CVEs publicadas que afetam produtos de Codeastro: 90 registro(s), com severidade, exploração e correções.
Online Classroom 14Gym Management System 11Apartment Visitor Management System 7Leave Management System 7Human Resource Management System 7Online Job Portal 5Student Attendance Management System 5Simple Online Leave Management System 4Real Estate Management System 4Ecommerce Website 3Simple Banking System 3Simple Inventory System 3Membership Management System 3Payroll System 3Ingredients Stock Management System 2Complaint Management System 2Online Leave Application 2Food Ordering System 1Online Catering Ordering System 1Simple Loan Management System 1Student Grading System 1Electricity Billing System 1
CVE-2026-7741
Média · 6.3
CWE-74 04/05/2026
CodeAstro Online Classroom studentlogin sql injection
A vulnerability was detected in CodeAstro Online Classroom 1.0. Impacted is an unknown function of the file /OnlineClassroom/studentlogin. Performing a manipulation of the argument sid results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.
CVE-2026-7196
Média · 6.3
CWE-74 27/04/2026
CodeAstro Online Classroom guestdetails sql injection
A security vulnerability has been detected in CodeAstro Online Classroom 1.0. Affected is an unknown function of the file /guestdetails. Such manipulation of the argument deleteid leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
CVE-2026-7148
Média · 6.3
CWE-74 27/04/2026
CodeAstro Online Classroom addnewfaculty sql injection
A flaw has been found in CodeAstro Online Classroom 1.0. This affects an unknown part of the file /addnewfaculty. Executing a manipulation of the argument fname can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.
CVE-2026-7071
Média · 5.3
CWE-200 26/04/2026
CodeAstro Online Job Portal user-cvs file information disclosure
A security vulnerability has been detected in CodeAstro Online Job Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /users/user-cvs/. The manipulation leads to file and directory information exposure. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
CVE-2026-7028
Média · 4.7
CWE-74 26/04/2026
CodeAstro Online Job Portal All Jobs delete-jobs.php sql injection
A security flaw has been discovered in CodeAstro Online Job Portal 1.0. The affected element is an unknown function of the file /admin/jobs-admins/delete-jobs.php of the component All Jobs Page. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.
CVE-2026-6201
Média · 5.4
CWE-266 13/04/2026
CodeAstro Online Job Portal Delete Job Posting job-delete.php access control
A vulnerability was identified in CodeAstro Online Job Portal 1.0. The impacted element is an unknown function of the file /jobs/job-delete.php of the component Delete Job Posting Handler. Such manipulation of the argument ID leads to improper access controls. The attack can be launched remotely. The exploit is publicly available and might be used.
CVE-2026-6033
Média · 6.3
CWE-74 10/04/2026
CodeAstro Online Classroom updatedetailsfromstudent.php sql injection
A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected is an unknown function of the file /updatedetailsfromstudent.php?eno=146891650. Executing a manipulation of the argument fname can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
CVE-2026-6010
Média · 6.3
CWE-74 10/04/2026
CodeAstro Online Classroom takeassessment2.php sql injection
A security flaw has been discovered in CodeAstro Online Classroom 1.0/2.php. Affected by this vulnerability is an unknown functionality of the file /OnlineClassroom/takeassessment2.php?exid=14. Performing a manipulation of the argument Q1 results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
CVE-2026-5580
Média · 6.3
CWE-74 05/04/2026
CodeAstro Online Classroom Parameter addvideos.php sql injection
A vulnerability was identified in CodeAstro Online Classroom 1.0. Impacted is an unknown function of the file /OnlineClassroom/addvideos.php of the component Parameter Handler. The manipulation of the argument videotitle leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
CVE-2026-5579
Média · 6.3
CWE-74 05/04/2026
CodeAstro Online Classroom Parameter updatedetailsfromfaculty.php sql injection
A vulnerability was determined in CodeAstro Online Classroom 1.0. This issue affects some unknown processing of the file /OnlineClassroom/updatedetailsfromfaculty.php?myfid=108 of the component Parameter Handler. Executing a manipulation of the argument fname can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
CVE-2026-5578
Média · 6.3
CWE-74 05/04/2026
CodeAstro Online Classroom Parameter addassessment.php sql injection
A vulnerability was found in CodeAstro Online Classroom 1.0. This vulnerability affects unknown code of the file /OnlineClassroom/addassessment.php of the component Parameter Handler. Performing a manipulation of the argument deleteid results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
CVE-2026-3137
Alta · 7.8
CWE-787 24/02/2026
CodeAstro Food Ordering System food_ordering.exe stack-based overflow
A security vulnerability has been detected in CodeAstro Food Ordering System 1.0. This affects an unknown function of the file food_ordering.exe. Such manipulation leads to stack-based buffer overflow. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used.
CVE-2025-70150
Crítica · 9.8
CWE-862 18/02/2026
Missing Authorization em Codeastro Membership Management System
CodeAstro Membership Management System 1.0 contains a missing authentication vulnerability in delete_members.php that allows unauthenticated attackers to delete arbitrary member records via the id parameter.
CVE-2025-70148
Alta · 7.5
CWE-862 18/02/2026
Missing Authorization em Codeastro Membership Management System
Missing authentication and authorization in print_membership_card.php in CodeAstro Membership Management System 1.0 allows unauthenticated attackers to access membership card data of arbitrary users via direct requests with a manipulated id parameter, resulting in insecure direct object reference (IDOR).
CVE-2025-70149
Crítica · 9.8
CWE-89 18/02/2026
SQL Injection em Codeastro Membership Management System
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in print_membership_card.php via the ID parameter.
CVE-2025-14900
Alta · 7.2
CWE-74 18/12/2025
CodeAstro Real Estate Management System Administrator Endpoint userdelete.php sql injection
A security vulnerability has been detected in CodeAstro Real Estate Management System 1.0. Affected is an unknown function of the file /admin/userdelete.php of the component Administrator Endpoint. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
CVE-2025-14899
Alta · 7.2
CWE-74 18/12/2025
CodeAstro Real Estate Management System Administrator Endpoint stateadd.php sql injection
A weakness has been identified in CodeAstro Real Estate Management System 1.0. This impacts an unknown function of the file /admin/stateadd.php of the component Administrator Endpoint. This manipulation causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.
CVE-2025-14898
Alta · 7.2
CWE-74 18/12/2025
CodeAstro Real Estate Management System Administrator Endpoint userbuilderdelete.php sql injection
A security flaw has been discovered in CodeAstro Real Estate Management System 1.0. This affects an unknown function of the file /admin/userbuilderdelete.php of the component Administrator Endpoint. The manipulation results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
CVE-2025-14897
Alta · 7.2
CWE-74 18/12/2025
CodeAstro Real Estate Management System Administrator Endpoint useragentdelete.php sql injection
A vulnerability was identified in CodeAstro Real Estate Management System 1.0. The impacted element is an unknown function of the file /admin/useragentdelete.php of the component Administrator Endpoint. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.
CVE-2025-13280
Crítica · 9.8
CWE-89 17/11/2025
CodeAstro Simple Inventory System Login index.php sql injection
A vulnerability was determined in CodeAstro Simple Inventory System 1.0. The impacted element is an unknown function of the file /index.php of the component Login. Executing a manipulation of the argument Username can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2025-13172
Alta · 8.8
CWE-89 14/11/2025
CodeAstro Gym Management System view-member-report.php sql injection
A security flaw has been discovered in CodeAstro Gym Management System 1.0. Affected is an unknown function of the file /admin/view-member-report.php. Performing a manipulation of the argument ID results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
CVE-2025-12610
Alta · 7.2
CWE-89 02/11/2025
CodeAstro Gym Management System view-progress-report.php sql injection
A vulnerability was determined in CodeAstro Gym Management System 1.0. This affects an unknown part of the file /admin/view-progress-report.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2025-12609
Alta · 8.8
CWE-89 02/11/2025
CodeAstro Gym Management System update-progress.php sql injection
A vulnerability was found in CodeAstro Gym Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/update-progress.php. Performing a manipulation of the argument id/ini_weight results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used.
CVE-2025-12261
Alta · 8.8
CWE-74 27/10/2025
CodeAstro Gym Management System remove-announcement.php sql injection
A vulnerability was found in CodeAstro Gym Management System 1.0. This affects an unknown function of the file /admin/actions/remove-announcement.php. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.
CVE-2025-12242
Alta · 8.8
CWE-74 27/10/2025
CodeAstro Gym Management System check-attendance.php sql injection
A vulnerability has been found in CodeAstro Gym Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/actions/check-attendance.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.