CVE-2024-40488

A Cross-Site Request Forgery (CSRF) vulnerability exists in Kashipara Live Membership System v1.0 . An attacker can trick an administrator into deleting valid member data by诱导 them to visit a crafted HTML page that triggers a Delete Member action at the /delete_members.php endpoint. Exploitation ...

CVE-2024-40487

A Stored Cross Site Scripting (XSS) vulnerability exists in the Kashipara Live Membership System v1.0 within the "/view_type.php" endpoint. The flaw allows remote attackers to execute arbitrary code by exploiting the membershipType parameter. To mitigate this risk, it is recommended to disable ac...

CVE-2024-40482

An unrestricted file upload vulnerability exists in the "/Membership/edit_member.php" component of Kashipara Live Membership System v1.0 . This flaw allows an attacker to execute arbitrary code by uploading a maliciously crafted PHP file . The impact is significant as it can lead to full system c...

CVE-2024-40486

A SQL injection vulnerability exists in the /index.php page of Kashipara Live Membership System v1.0 . This flaw allows remote attackers to execute arbitrary SQL commands and bypass login mechanisms by exploiting the email or password login parameters. Practical consequences include unauthorized ...