CVE-2025-67147

Multiple SQL Injection vulnerabilities exist in amansuryawanshi Gym-Management-System-PHP 1.0 via the 'name', 'email', and 'comment' parameters in (1) submit_contact.php, the 'username' and 'pass_key' parameters in (2) secure_login.php, and the 'login_id', 'pwfield', and 'login_key' parameters in (3) change_s_pwd.php. An unauthenticated or authenticated attacker can exploit these issues to bypass authentication, execute arbitrary SQL commands, modify database records, delete data, or escalate privileges to administrator level.

CVSS v3.1 CNA

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.39% chance of exploitation in the next 30 days, 31st percentile

Published

2026-01-12

Proof-of-concept exploits (1)

• sivaadityacoder/CVE-2025-67146-CVE-2025-671470★ · 2026-04-25

References

• CVE Record
• NVD entry

Related

• CVE-2025-67146
• CVE-2025-68621
• CVE-2026-22038