Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-12261: CodeAstro Gym Management System allows attackers to access sensitive data

CVE-2025-12261 · published 1 year ago

Summary

CodeAstro Gym Management System version 1.0 has a security flaw that allows hackers to access sensitive data by manipulating certain inputs. This could potentially allow an attacker to access and steal sensitive information. We recommend updating to a newer version of the system or seeking assistance from the developer to patch this vulnerability.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
codeastro	gym_management_system	1.0 `cpe:2.3:a:codeastro:gym_management_system:1.0:::::::*`

Original advisory text

A vulnerability was found in CodeAstro Gym Management System 1.0. This affects an unknown function of the file /admin/actions/remove-announcement.php. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.

References

https://codeastro.com/ Product
https://github.com/JeromClown/cve/issues/1 Exploit Issue Tracking
https://vuldb.com/?ctiid.329932 Permissions Required VDB Entry
https://vuldb.com/?id.329932 Third Party Advisory VDB Entry
https://vuldb.com/?submit.674022 Third Party Advisory VDB Entry

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

2.1 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-74Injection

CWE-89SQL Injection

Timeline

Published27 Oct 2025

Updated4 Nov 2026

First seen6 Mar 2026

Sources

CVE-2025-12261 · NVD

Track software like this

Free during beta