Published At-12 Jan, 2026 | 21:15
Updated At-13 Jan, 2026 | 14:03
Multiple SQL Injection vulnerabilities exist in amansuryawanshi Gym-Management-System-PHP 1.0 via the 'name', 'email', and 'comment' parameters in (1) submit_contact.php, the 'username' and 'pass_key' parameters in (2) secure_login.php, and the 'login_id', 'pwfield', and 'login_key' parameters in (3) change_s_pwd.php. An unauthenticated or authenticated attacker can exploit these issues to bypass authentication, execute arbitrary SQL commands, modify database records, delete data, or escalate privileges to administrator level.
CISA Catalog
| Date Added | Due Date | Vulnerability Name | Required Action |
|---|
| N/A | | |
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
| Type | Version | Base score | Base severity | Vector |
|---|
| Secondary | 3.1 | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Type: Secondary
Version: 3.1
Base score: 9.8
Base severity: CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
| CWE ID | Type | Source |
|---|
| CWE-89 | Secondary | 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
Type: Secondary
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Change History
0Changes found