CVE-2025-11589
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
A SQL injection vulnerability was discovered in Gym Management System 1.0 in /admin/user-payment.php. Manipulation of the plan argument allows remote SQL injection. The exploit is public.
Risk Assessment
An attacker could access or modify payment data, potentially leading to serious financial consequences.
Recommendation
Apply patches as soon as possible and secure the application against SQL injection attacks.
Other vulnerabilities in Gym Management System
See all- CVE-2025-67146Critical
Multiple SQL Injection vulnerabilities in GYM-MANAGEMENT-SYSTEM 1.0 by AbhishekMali21, in 'name' and 'id' parameters in various scripts. An unauthenticated attacker can inject malicious SQL commands, leading to unauthorized data extraction, authentication bypass, or database modification.
- CVE-2025-12242Medium
A vulnerability has been found in CodeAstro Gym Management System 1.0. The file /admin/actions/check-attendance.php is affected. Manipulation of the argument ID leads to SQL injection. The attack can be launched remotely, and the exploit has been disclosed to the public.
- CVE-2025-11592Medium
A SQL injection vulnerability was detected in Gym Management System 1.0 in /admin/edit-equipmentform.php. Manipulation of the ID argument allows remote SQL injection. The exploit is public.
Original NVD description (English source)
A security flaw has been discovered in CodeAstro Gym Management System 1.0. Affected is an unknown function of the file /admin/user-payment.php. Performing a manipulation of the argument plan results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS