CVE-2025-11592
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
A SQL injection vulnerability was detected in Gym Management System 1.0 in /admin/edit-equipmentform.php. Manipulation of the ID argument allows remote SQL injection. The exploit is public.
Risk Assessment
An attacker could manipulate database queries, potentially leading to data integrity compromise or theft.
Recommendation
Immediately apply patches and use mechanisms to prevent SQL injection.
Other vulnerabilities in Gym Management System
See all- CVE-2025-67146Critical
Multiple SQL Injection vulnerabilities in GYM-MANAGEMENT-SYSTEM 1.0 by AbhishekMali21, in 'name' and 'id' parameters in various scripts. An unauthenticated attacker can inject malicious SQL commands, leading to unauthorized data extraction, authentication bypass, or database modification.
- CVE-2025-12242Medium
A vulnerability has been found in CodeAstro Gym Management System 1.0. The file /admin/actions/check-attendance.php is affected. Manipulation of the argument ID leads to SQL injection. The attack can be launched remotely, and the exploit has been disclosed to the public.
- CVE-2025-11589Medium
A SQL injection vulnerability was discovered in Gym Management System 1.0 in /admin/user-payment.php. Manipulation of the plan argument allows remote SQL injection. The exploit is public.
Original NVD description (English source)
A vulnerability was detected in CodeAstro Gym Management System 1.0. This affects an unknown part of the file /admin/edit-equipmentform.php. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit is now public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS