CodeAstro vulnerabilities
We track 86 vulnerabilities in CodeAstro products across 34 products. 86 are rated high or critical, and none are known to be exploited. The most recent was published on August 20, 2026.
Latest CodeAstro vulnerabilities
- 9.8 Critical severity
Real Estate Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in CodeAstro Real Estate Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/index.php. The manipulation of the argument User leads to sql injection. The attack can be in
- 9.8 Critical severity
Real Estate Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in CodeAstro Real Estate Management System 1.0. It has been classified as critical. This affects an unknown part of the file /login.php. The manipulation of the argument email leads to sql injection. It is possible to initiate the att
- 9.8 Critical severity
Pharmacy Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in CodeAstro Pharmacy Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /index.php of the component Login. The manipulation of the argument Username leads to sql inj
- 9.8 Critical severity
Membership Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in CodeAstro Membership Management System 1.0. This vulnerability affects unknown code of the file renew.php?id=6. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely
- 8.0 High severity
Bus Ticket Booking System: Authorization Bypass Through User-Controlled Key
Insecure Direct Object Reference (IDOR) in Codeastro Bus Ticket Booking System v1.0 allows unauthorized access to user profiles. By manipulating the user ID in the URL, an attacker can access another user's profile without proper authentication or authorizatio
- 8.8 High severity
Internet Banking System: Unrestricted Upload of File with Dangerous Type
A Remote Code Execution (RCE) vulnerability exists in Code Astro Internet Banking System 2.0.0 due to improper file upload validation in the profile_pic parameter within pages_view_client.php.
- 8.8 High severity
Student Grading System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in CodeAstro Student Grading System 1.0. This affects an unknown part of the file studentsubject.php. The manipulation of the argument studentId leads to sql injection. It is possible to initiate the
- 9.8 Critical severity
Car Rental System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in CodeAstro Car Rental System 1.0. Affected by this issue is some unknown functionality of the file /returncar.php. The manipulation of the argument ID leads to sql injection. The attack may be
- 7.5 High severity
Complaint Management System: Improper Access Control
Incorrect access control in the endpoint /admin/m_delete.php of CodeAstro Complaint Management System v1.0 allows unauthorized attackers to arbitrarily delete complaints via modification of the id parameter.
- 7.3 High severity
Internet Banking System: Cross-Site Request Forgery
A Cross Site Request Forgery (CSRF) vulnerability in Code Astro Internet banking system 2.0.0 allows remote attackers to execute arbitrary JavaScript on the admin page (pages_account), potentially leading to unauthorized actions such as changing account settin
- 8.8 High severity
Online Food Ordering System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in CodeAstro Online Food Ordering System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/update_users.php of the component Update User Page. The manipulation of the
- 9.8 Critical severity
Simple Loan Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in CodeAstro Simple Loan Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /index.php of the component Login. The manipulation of the argument email leads t
- 9.8 Critical severity
Car Rental System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in CodeAstro Car Rental System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /bookingconfirm.php. The manipulation of the argument driver_id_from_dropdown leads to sql in
- 9.8 Critical severity
House Rental Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in CodeAstro House Rental Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /signin.php. The manipulation of the argument u/p leads to sql injection. The attack may
- 9.8 Critical severity
House Rental Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in CodeAstro House Rental Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /ownersignup.php. The manipulation of the argument f/e/p/m/o/n/c/s/ci/a leads to
- 8.8 High severity
Blood Donor Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in CodeAstro Blood Donor Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /pages/deletedannounce.php. The manipulation of the argument id leads to sql injection. The attack may b
- 9.8 Critical severity
Complaint Management System: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in CodeAstro Complaint Management System v.1.0 allows a remote attacker to execute arbitrary code and escalate privileges via the id parameter of the delete.php component.
- 8.8 High severity
Complaint Management System: Authorization Bypass Through User-Controlled Key
An IDOR vulnerability in CodeAstro's Complaint Management System v1.0 (version with 0 updates) enables an attacker to execute arbitrary code and obtain sensitive information via the delete.php file and modifying the id parameter.
- 8.8 High severity
Hospital Management System: Unrestricted Upload of File with Dangerous Type
A vulnerability, which was classified as critical, was found in CodeAstro Hospital Management System 1.0. Affected is an unknown function of the file /backend/doc/his_doc_update-account.php. The manipulation of the argument doc_dpic leads to unrestricted uploa
- 7.2 High severity
Real Estate Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in CodeAstro Real Estate Management System up to 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /aboutedit.php of the component About Us Page. The manipulation of the argument id leads to sq
- 7.2 High severity
Real Estate Management System: Unrestricted Upload of File with Dangerous Type
A vulnerability classified as problematic was found in CodeAstro Real Estate Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /aboutedit.php of the component About Us Page. The manipulation of the argument aimage le
- 7.2 High severity
Real Estate Management System: Unrestricted Upload of File with Dangerous Type
A vulnerability classified as problematic has been found in CodeAstro Real Estate Management System 1.0. Affected is an unknown function of the file /aboutadd.php of the component About Us Page. The manipulation of the argument aimage leads to unrestricted upl
- 7.5 High severity
membership_management_system: Exposure of Sensitive Information to an Unauthorized Actor
The Directory Listing in /uploads/ Folder in CodeAstro Membership Management System 1.0 exposes the structure and contents of directories, potentially revealing sensitive information.
- 7.2 High severity
Online Railway Reservation System: Unrestricted Upload of File with Dangerous Type
A vulnerability was found in CodeAstro Online Railway Reservation System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/emp-profile-avatar.php of the component Profile Photo Update Handler. The manipulat
- 9.8 Critical severity
Ecommerce Site: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in CodeAstro Ecommerce Site 1.0. Affected by this vulnerability is an unknown functionality of the file action.php of the component Search. The manipulation of the argument cat_id/brand_id/keyword leads to sql i
- 7.2 High severity
Membership Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in CodeAstro Membership Management System 1.0. Affected is an unknown function of the file /add_members.php. The manipulation of the argument fullname leads to sql injection. It is possible to launch the at
- 8.8 High severity
hospital_management_system: Improper Neutralization of Special Elements used in an SQL Command
Hospital Management System 1.0 was discovered to contain a SQL injection vulnerability via the pat_number parameter at his_admin_view_single_patient.php.
- 8.1 High severity
hospital_management_system: Improper Neutralization of Special Elements used in an SQL Command
Hospital Management System 1.0 was discovered to contain a SQL injection vulnerability via the pat_number parameter at his_doc_view_single_patien.php.
- 7.2 High severity
Membership Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in CodeAstro Membership Management System 1.0. This vulnerability affects unknown code of the file settings.php. The manipulation of the argument currency leads to sql injection. The attack can be initiated remo
- 7.5 High severity
House Rental Management System: Missing Authentication for Critical Functionality
A vulnerability was found in CodeAstro House Rental Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file booking.php/owner.php/tenant.php. The manipulation leads to missing authentication. Th
- 8.8 High severity
membership_management_system: Unrestricted Upload of File with Dangerous Type
An Unrestricted File Upload vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary code via upload of a crafted php file in the settings.php component.
- 9.1 Critical severity
membership_management_system: Improper Neutralization of Special Elements used in an SQL Command
A SQL Injection vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary SQL commands via the membershipType and membershipAmount parameters in the add_type.php component.
- 8.8 High severity
membership_management_system: Improper Neutralization of Special Elements used in an SQL Command
A SQL Injection vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary SQL commands via the email parameter in the index.php component.
- 9.8 Critical severity
House Rental Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in CodeAstro House Rental Management System 1.0. Affected by this issue is some unknown functionality of the file signing.php. The manipulation of the argument uname/password leads to sql inject
- 7.2 High severity
Membership Management System: Unrestricted Upload of File with Dangerous Type
A vulnerability was found in CodeAstro Membership Management System 1.0. It has been classified as critical. This affects an unknown part of the component Add Members Tab. The manipulation of the argument Member Photo leads to unrestricted upload. It is possib
- 7.2 High severity
Membership Management System: Unrestricted Upload of File with Dangerous Type
A vulnerability was found in CodeAstro Membership Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /uploads/ of the component Logo Handler. The manipulation leads to unrestricted upload. The att
- 9.8 Critical severity
Restaurant POS System: Unrestricted Upload of File with Dangerous Type
A vulnerability, which was classified as critical, was found in CodeAstro Restaurant POS System 1.0. This affects an unknown part of the file update_product.php. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The
- 7.5 High severity
Employee Task Management System: Improper Resource Shutdown or Release
A vulnerability has been found in CodeAstro Employee Task Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file \employee-tasks-php\attendance-info.php. The manipulation of the argument aten
- 7.5 High severity
Real Estate Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in CodeAstro Real Estate Management System up to 1.0. This affects an unknown part of the file propertydetail.php. The manipulation of the argument pid leads to sql injection. It is possible to initiate the
- 9.8 Critical severity
Online Food Ordering System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in CodeAstro Online Food Ordering System 1.0. This vulnerability affects unknown code of the file /admin/ of the component Admin Panel. The manipulation of the argument Username leads to sql injection. The attac