CVE-2025-10851

HIGH

Campcodes Gym Management System 1.0 - SQL Injection via Username Parameter in /ajax.php

Title source: llm
STIX 2.1

Description

A security flaw has been discovered in Campcodes Gym Management System 1.0. Impacted is an unknown function of the file /ajax.php?action=login. Performing manipulation of the argument Username results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited.

References (5)

Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.325210
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.325210
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.657939
Product product
https://www.campcodes.com/

Scores

CVSS v3 7.3
EPSS 0.0004
EPSS Percentile 12.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-74 CWE-89
Status published
Products (1)
campcodes/gym_management_system 1.0
Published Sep 23, 2025
Tracked Since Feb 18, 2026