CVE-2026-7071-access-Control

CodeAstro 在线求职门户（PHP MySQL）中的未认证简历泄露 详细信息 供应商： CodeAstro 产品： 基于 PHP MySQL 的在线求职门户项目 版本： 1.0 漏洞类型： 访问控制不当 / 信息泄露 CWE： CWE-284、CWE-200、CWE-548 受影响端点： /users/user-cvs/ 影响： 未认证即可访问所有用户简历 描述 该应用程序将用户简历存储在公开可访问的目录（/users/user-cvs/）中，未强制执行身份验证或授权检查。 未认证的攻击者可以通过请求文件 URL 直接访问并下载任何用户的简历。...

CVE-2026-7028-SQLI

CodeAstro-Online-Job-Portal-SQLi-Delete-All Detalles Proveedor: CodeAstro Producto: Proyecto de Portal de Empleo en Línea en PHP MySQL Versión: 1.0 Tipo de vulnerabilidad: Inyección SQL CWE: CWE-89 Endpoint afectado: /admin/jobs-admins/delete-jobs.php Parámetro: id GET Impacto: Permite la...

CVE-2026-6201-IDOR

CodeAstro 在线求职门户中的越权访问漏洞允许任意删除职位 详细信息 供应商： CodeAstro 产品： PHP MySQL 在线求职门户项目 版本： 1.0 漏洞类型： 越权访问（IDOR） CWE： CWE-639 受影响文件： /jobs/job-delete.php 参数： id（GET） 影响： 经过身份验证的雇主可以通过操纵请求中的 id 参数删除任何其他雇主的职位发布。 描述 由 CodeAstro 开发的 PHP MySQL 在线求职门户项目在处理删除请求之前，未能验证经过身份验证的用户是否拥有该职位发布。通过更改 GET 请求中的 id...

CVE-2026-37749

CVE-2026-37749 — CodeAstro 简单考勤管理系统 1.0 - SQL 注入 详细信息 字段| 信息 ---|--- CVE ID| CVE-2026-37749 类型| SQL 注入 → 身份验证绕过 严重性| 严重（CVSSv3：9.8） 厂商| CodeAstro 产品| 简单考勤管理系统 版本| 1.0 发现者| Varad AP Mene 日期| 2026-04-16 CWE| CWE-89 描述 CodeAstro 简单考勤管理系统 v1.0 的 index.php 登录表单中存在 SQL 注入漏洞。username POST...

CVE-2025-70149-SQL-Injection

CVE-2025-70149 — SQL Injection Research Project Overview Security research project demonstrating exploitation and mitigation of CVE-2025-70149, a critical SQL Injection vulnerability CVSS 9.8/10 in CodeAstro Membership Management System v1.0. CVE Details...

CVE-2026-77681

A vulnerability was identified in CodeAstro Online Job Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /users/update-profile.php. The manipulation of the argument Name leads to unrestricted upload. The attack can be initiated remotely. The exploit is publicly...

EUVD-2026-63876

A vulnerability was identified in CodeAstro Online Job Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /users/update-profile.php. The manipulation of the argument Name leads to unrestricted upload. The attack can be initiated remotely. The exploit is publicly...

CVE-2026-77681 CodeAstro Online Job Portal update-profile.php unrestricted upload

A vulnerability was identified in CodeAstro Online Job Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /users/update-profile.php. The manipulation of the argument Name leads to unrestricted upload. The attack can be initiated remotely. The exploit is publicly...

CVE-2026-77681

CodeAstro Online Job Portal 1.0 is affected by an unrestricted file upload vulnerability in the file /users/update-profile.php. Manipulation of the Name argument allows a remote, authenticated attacker (low privileges) to upload arbitrary files, leading to low impact on confidentiality, integrity...

CVE-2026-77020

A vulnerability was identified in CodeAstro Apartment Visitor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file password-recovery.php. The manipulation of the argument email leads to sql injection. Remote exploitation of the attack is possible. The...

CVE-2026-77019

A vulnerability was determined in CodeAstro Apartment Visitor Management System 1.0. Affected is an unknown function of the file /apartment-visitor/forgotpw.php. Executing a manipulation of the argument secode can lead to sql injection. The attack may be launched remotely. The exploit has been...

EUVD-2026-63466

A vulnerability was identified in CodeAstro Apartment Visitor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file password-recovery.php. The manipulation of the argument email leads to sql injection. Remote exploitation of the attack is possible. The...

CVE-2026-77020 CodeAstro Apartment Visitor Management System password-recovery.php sql injection

A vulnerability was identified in CodeAstro Apartment Visitor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file password-recovery.php. The manipulation of the argument email leads to sql injection. Remote exploitation of the attack is possible. The...

CVE-2026-77020 CodeAstro Apartment Visitor Management System password-recovery.php sql injection

A vulnerability was identified in CodeAstro Apartment Visitor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file password-recovery.php. The manipulation of the argument email leads to sql injection. Remote exploitation of the attack is possible. The...

CVE-2026-77020

CodeAstro Apartment Visitor Management System 1.0 is vulnerable to SQL injection via the email argument in password-recovery.php. Exploitation requires no authentication and is possible over the network; a proof-of-concept exploit is publicly available. No patch version or vendor fix is provided ...

CVE-2026-77019 CodeAstro Apartment Visitor Management System forgotpw.php sql injection

A vulnerability was determined in CodeAstro Apartment Visitor Management System 1.0. Affected is an unknown function of the file /apartment-visitor/forgotpw.php. Executing a manipulation of the argument secode can lead to sql injection. The attack may be launched remotely. The exploit has been...

EUVD-2026-63421

A vulnerability was determined in CodeAstro Apartment Visitor Management System 1.0. Affected is an unknown function of the file /apartment-visitor/forgotpw.php. Executing a manipulation of the argument secode can lead to sql injection. The attack may be launched remotely. The exploit has been...

CVE-2026-77019

CodeAstro Apartment Visitor Management System 1.0 has a SQL injection in /apartment-visitor/forgotpw.php via the secode argument, exploitable remotely without authentication (CVSS 7.5 HIGH). A proof-of-concept exploit is publicly disclosed; no patch version is provided. Exploitation details are n...

PT-2026-79056

A vulnerability was determined in CodeAstro Apartment Visitor Management System 1.0. Affected is an unknown function of the file /apartment-visitor/forgotpw.php. Executing a manipulation of the argument secode can lead to sql injection. The attack may be launched remotely. The exploit has been...

PT-2026-79068

A vulnerability was identified in CodeAstro Apartment Visitor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file password-recovery.php. The manipulation of the argument email leads to sql injection. Remote exploitation of the attack is possible. The...