CVE-2025-12261

MediumCVSS 6.3

Published: 27/10/2025(UTC)Updated: 30/09/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.45%

37th percentile - higher than 37% of all known CVEs

Summary

A SQL injection vulnerability was found in CodeAstro Gym Management System 1.0 in the file /admin/actions/remove-announcement.php. Manipulation of the argument ID allows remote attack. The exploit has been made public and could be used.

Risk Assessment

An attacker can remotely manipulate SQL queries, potentially leading to unauthorized data access or modification. The public exploit increases the risk of active exploitation.

Recommendation

Apply vendor patches or restrict access to /admin/actions/remove-announcement.php. Also use prepared statements and validate input.

Other vulnerabilities in CodeAstro Gym Management System

CVE-2025-13172Medium
A security flaw has been discovered in CodeAstro Gym Management System 1.0. An unknown function in /admin/view-member-report.php is affected. Manipulation of the ID argument results in SQL injection. The attack can be initiated remotely and the exploit has been released.

Original NVD description (English source)

A vulnerability was found in CodeAstro Gym Management System 1.0. This affects an unknown function of the file /admin/actions/remove-announcement.php. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS