CVE-2025-67146

CVSS Score & Metrics

Base Score

9.4 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L                                    

Vulnerability Description

Multiple SQL Injection vulnerabilities exist in AbhishekMali21 GYM-MANAGEMENT-SYSTEM 1.0 via the 'name' parameter in (1) member_search.php, (2) trainer_search.php, and (3) gym_search.php, and via the 'id' parameter in (4) payment_search.php. An unauthenticated remote attacker can exploit these issues to inject malicious SQL commands, leading to unauthorized data extraction, authentication bypass, or modification of database contents.

Vulnerability Details

Published Date

January 12, 2026

Last Modified

January 13, 2026

CWE ID

CWE-89

Source

NVD

External References

https://github.com/AbhishekMali21/GYM-MANAGEMENT-SYSTEM/issues/4

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment