CVE-2025-10851

Campcodes Gym Management System ajax.php sql injection

CVSS 6.9 MEDIUMEPSS 0.4%CWE-74 CWE-89

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 6.9EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

23 set 2025Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

A security flaw has been discovered in Campcodes Gym Management System 1.0. Impacted is an unknown function of the file /ajax.php?action=login. Performing manipulation of the argument Username results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Produtos afetados

Campcodes · Gym Management System

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://vuldb.com/?ctiid.325210 https://vuldb.com/?id.325210 https://vuldb.com/?submit.657939 https://www.campcodes.com/https://www.yuque.com/yuqueyonghuexlgkz/zepczx/esau5fkdf0upv8s6?singleDoc