CVE-2025-67146

critical · 9.4

Multiple SQL Injection vulnerabilities exist in AbhishekMali21 GYM-MANAGEMENT-SYSTEM 1.0 via the 'name' parameter in (1) member_search.php, (2) trainer_search.php, and (3) gym_search.php, and via the 'id' parameter in (4) payment_search.php. An unauthenticated remote attacker can exploit these issues to inject malicious SQL commands, leading to unauthorized data extraction, authentication bypass, or modification of database contents.

9.4

CVSS

0.6%

EPSS (exploit prob.)

49th

EPSS percentile

2026-01-12

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Weaknesses

CWE-89

Affected products

Vendor	Product	Affected versions
abhishekmali21	gym_management_system	1.0

Check a specific version with /api/v1/cve/match.

References

https://github.com/AbhishekMali21/GYM-MANAGEMENT-SYSTEM/issues/4

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-67146