CVE-2026-5206
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Simple Gym Management System 1.0 is vulnerable to SQL Injection in the Payment Handler component. Parameters Payment_id, Amount, customer_id, payment_type, and customer_name are susceptible to manipulation.
Risk Assessment
An attacker can remotely execute SQL queries, potentially leading to data leakage, modification, or deletion from the database.
Recommendation
Use parameterized SQL queries or an ORM to prevent SQL injection. Immediately update the system or apply a patch.
Original NVD description (English source)
A security vulnerability has been detected in code-projects Simple Gym Management System 1.0. This vulnerability affects unknown code of the component Payment Handler. The manipulation of the argument Payment_id/Amount/customer_id/payment_type/customer_name leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.