CVE-2025-29018

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Code Astro Internet Banking System 2.0.0 due to improper neutralization of input in the name parameter of pages_add_acc_type.php. Attackers can inject malicious JavaScript that executes whenever an administrator or user visits the Ma...

CVE-2024-0194

CodeAstro Internet Banking System up to version 1.0 is affected by CVE-2024-0194 in the Profile Picture Handler component (pages_account.php). The vulnerability enables unrestricted file upload and may be exploited remotely. Multiple connected sources confirm the issue and the presence of an expl...

CVE-2025-29017

A Remote Code Execution (RCE) vulnerability exists in Code Astro Internet Banking System 2.0.0 due to improper file upload validation in the profile_pic parameter within pages_view_client.php. An attacker can bypass security checks by modifying upload requests to submit a malicious PHP file (e.g....

CVE-2025-29015

Code Astro Internet Banking System 2.0.0 is vulnerable to Stored Cross-Site Scripting (XSS) due to the improper handling of the name parameter in the /admin/pages_account.php endpoint. An attacker can inject and store malicious JavaScript code, which executes whenever an administrator views the a...

CVE-2024-56924

The Code Astro Internet banking system version 2.0.0 is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability. The root cause is the lack of CSRF protection mechanisms on the account modification page (specifically pages_account.php ), allowing remote attackers to perform unauthorized ...