VULNERABILITY INTELLIGENCE

CVE-2025-67146

CVSS score9.4 CRITICAL
EPSS probability0.62%
CISA KEVNot currently listed
Published2026-01-12
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Description

Multiple SQL Injection vulnerabilities exist in AbhishekMali21 GYM-MANAGEMENT-SYSTEM 1.0 via the 'name' parameter in (1) member_search.php, (2) trainer_search.php, and (3) gym_search.php, and via the 'id' parameter in (4) payment_search.php. An unauthenticated remote attacker can exploit these issues to inject malicious SQL commands, leading to unauthorized data extraction, authentication bypass, or modification of database contents.

Weakness classification

  • 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-89

Primary references