Paper/Archive/CVE-2025-70150

CVE-2025-70150

mitre — CodeAstro Membership Management System 1.0 contains a missing authentication vulnerability in delete_members.php that allows unauthentica…

EPSS 0.7%public exploit CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 54.4.544 × 2010.9 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

CodeAstro Membership Management System 1.0 contains a missing authentication vulnerability in delete_members.php that allows unauthenticated attackers to delete arbitrary member records via the id parameter.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

Scores by source

mitre (CNA)9.8CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refphpscriptsonline.com/product/membership-management-software exploityoungkevinn.github.io/posts/CVE-2025-70150-Membership-Unauth-Delete ref0x0bito.github.io/posts/CVE-2025-70150-Membership-Unauth-Delete