NVD disclosure day
CVE-2025-70152
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
The Scholars Tracking System is vulnerable to SQL injection through its unauthenticated administrative endpoints. This could allow an attacker to manipulate user data, leading to unauthorized access or modification. Confirm if this system is in use and exposed to assess risk.
CVE-2025-70150
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability exists in the CodeAstro Membership Management System, allowing unauthenticated attackers to delete arbitrary member records. This missing authentication flaw in `delete_members.php` could lead to data loss or service disruption if the system is reachable.
CVE-2025-70149
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical SQL injection vulnerability exists in the CodeAstro Membership Management System's `print_membership_card.php` script, allowing network-accessible exploitation without authentication. This could lead to unauthorized access or modification of sensitive membership data. It is uncertain if this system is in use
CVE-2025-70146
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Remote attackers can add or delete records in the ProjectWorlds Online Time Table Generator by sending direct HTTP requests to administrative scripts without a valid session. This missing authentication vulnerability could lead to unauthorized data manipulation, impacting system data integrity and availability. It is i
CVE-2025-70141
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An access control vulnerability exists in SourceCodester Customer Support System 1.0, allowing unauthenticated remote attackers to perform sensitive administrative operations. This could result in unauthorized creation, modification, or deletion of customer data, user accounts, and other application records. Organizati