CVE-2026-4550

4.7 MEDIUM
Published: March 22, 2026 Modified: March 22, 2026
View on NVD

Description

A vulnerability has been found in code-projects Simple Gym Management System up to 1.0. This affects an unknown part of the file /gym/func.php. Such manipulation of the argument Trainer_id/fname leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
https://code-projects.org/
Source: cna@vuldb.com
https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Time-Based%20Blind%20SQL%20Injection%20in%20%20Simple%20Gym%20Management%20System%20in%20PHP%20Product.md
Source: cna@vuldb.com
https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Time-Based%20Blind%20SQL%20Injection%20in%20Simple%20Gym%20Management%20System%20in%20PHP.md
Source: cna@vuldb.com
https://vuldb.com/?ctiid.352377
Source: cna@vuldb.com
https://vuldb.com/?id.352377
Source: cna@vuldb.com
https://vuldb.com/?submit.774838
Source: cna@vuldb.com
https://vuldb.com/?submit.774839
Source: cna@vuldb.com

7 reference(s) from NVD

Quick Stats

CVSS v3 Score
4.7 / 10.0
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

CWE-74 CWE-89

Related CVEs

CVE-2026-4552 8.8
CVE-2026-4551 8.8
CVE-2026-4549 3.1
CVE-2026-4548 6.3
CVE-2026-4547 4.3