CodeAstro Membership Management System 1.0 contains a missing authentication vulnerability in delete_members.php that allows unauthenticated attackers to delete arbitrary member records via the id parameter.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://youngkevinn.github.io/posts/CVE-2025-70150-Membership-Unauth-Delete/ Exploit, Mitigation, Third Party Advisory
- https://youngkevinn.github.io/posts/CVE-2025-70150-Membership-Unauth-Delete/ Exploit, Mitigation, Third Party Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 9.8 · codeastroNVD modified 2026-10-13 10:10
Affected (CPE criteria) 1
cpe:2.3:a:codeastro:membership_management_system:1.0:*:*:*:*:*:*:*
References 4
- https://0x0bito.github.io/posts/CVE-2025-70150-Membership-Unauth-Delete/
- https://www.phpscriptsonline.com/product/membership-management-software Product
- https://youngkevinn.github.io/posts/CVE-2025-70150-Membership-Unauth-Delete/ Exploit, Mitigation, Third Party Advisory
- https://youngkevinn.github.io/posts/CVE-2025-70150-Membership-Unauth-Delete/ Exploit, Mitigation, Third Party Advisory