CVE-2025-12610
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
A vulnerability was determined in CodeAstro Gym Management System 1.0. An unknown part of /admin/view-progress-report.php is affected, where manipulation of the ID argument can lead to SQL injection. The attack may be launched remotely and the exploit has been publicly disclosed.
Risk Assessment
A remote attacker could execute arbitrary SQL queries, potentially resulting in data leakage or modification. The public availability of the exploit increases the risk of exploitation.
Recommendation
Immediately update the application to a patched version or implement input validation. Also restrict access to the admin panel.
Other vulnerabilities in Gym Management System
See all- CVE-2025-67146Critical
Multiple SQL Injection vulnerabilities in GYM-MANAGEMENT-SYSTEM 1.0 by AbhishekMali21, in 'name' and 'id' parameters in various scripts. An unauthenticated attacker can inject malicious SQL commands, leading to unauthorized data extraction, authentication bypass, or database modification.
- CVE-2025-12242Medium
A vulnerability has been found in CodeAstro Gym Management System 1.0. The file /admin/actions/check-attendance.php is affected. Manipulation of the argument ID leads to SQL injection. The attack can be launched remotely, and the exploit has been disclosed to the public.
- CVE-2025-11592Medium
A SQL injection vulnerability was detected in Gym Management System 1.0 in /admin/edit-equipmentform.php. Manipulation of the ID argument allows remote SQL injection. The exploit is public.
- CVE-2025-11589Medium
A SQL injection vulnerability was discovered in Gym Management System 1.0 in /admin/user-payment.php. Manipulation of the plan argument allows remote SQL injection. The exploit is public.
Original NVD description (English source)
A vulnerability was determined in CodeAstro Gym Management System 1.0. This affects an unknown part of the file /admin/view-progress-report.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS