CVE-2025-70150 PUBLISHED

Assigner: mitre
Reserved: 09.01.2026 Published: 18.02.2026 Updated: 18.02.2026

CodeAstro Membership Management System 1.0 contains a missing authentication vulnerability in delete_members.php that allows unauthenticated attackers to delete arbitrary member records via the id parameter.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N
CVSS Score: 9.8

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	n/a
Product	n/a
Versions	Version n/a is affected

References

https://www.phpscriptsonline.com/product/membership-management-software
https://youngkevinn.github.io/posts/CVE-2025-70150-Membership-Unauth-Delete/

Problem Types

n/a text