CVE-2025-13172

MediumCVSS 6.3

Published: 14/11/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

19th percentile - higher than 19% of all known CVEs

Summary

A security flaw has been discovered in CodeAstro Gym Management System 1.0. An unknown function in /admin/view-member-report.php is affected. Manipulation of the ID argument results in SQL injection. The attack can be initiated remotely and the exploit has been released.

Risk Assessment

SQL injection could allow an attacker unauthorized access to the database, including reading, modifying, or deleting data, potentially leading to data confidentiality and integrity breaches.

Recommendation

Update CodeAstro Gym Management System to the latest version or apply security patches. Also, use parameterized queries and input validation.

Other vulnerabilities in CodeAstro Gym Management System

CVE-2025-12261Medium
A SQL injection vulnerability was found in CodeAstro Gym Management System 1.0 in the file /admin/actions/remove-announcement.php. Manipulation of the argument ID allows remote attack. The exploit has been made public and could be used.

Original NVD description (English source)

A security flaw has been discovered in CodeAstro Gym Management System 1.0. Affected is an unknown function of the file /admin/view-member-report.php. Performing a manipulation of the argument ID results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS