CVE-2025-4360

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, has been found in itsourcecode Gym Management System 1.0. Affected by this issue is some unknown functionality of the file /view_member.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
itsourcecode	Gym Management System	1.0

References

https://github.com/arpcyber010/CVE/issues/2Exploit, Issue Tracking, Third Party Advisory
https://itsourcecode.com/Product
https://vuldb.com/?ctiid.307478Permissions Required, VDB Entry
https://vuldb.com/?id.307478Third Party Advisory, VDB Entry
https://vuldb.com/?submit.564748Third Party Advisory, VDB Entry

Timeline

Published: May 6, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-43619.8A vulnerability classified as critical has been found in PHPGurukul Company Visitor Management System 2.0. This affects an unknown part of t CVE-2025-43629.8A vulnerability classified as critical was found in itsourcecode Gym Management System 1.0. This vulnerability affects unknown code of the f CVE-2025-43639.8A vulnerability, which was classified as critical, has been found in itsourcecode Gym Management System 1.0. This issue affects some unknown CVE-2025-43648.7The affected products could allow an unauthenticated attacker to access system information that could enable further access to sensitive fil CVE-2025-43657.5Arbitrary file read in NetScaler Console and NetScaler SDX (SVM)CVE-2025-43666.1A request smuggling vulnerability identified within Pingora’s proxying framework, pingora-proxy, allows malicious HTTP requests to be inject CVE-2025-43675.4The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpdm_user_dashboard shortcode in all CVE-2025-43689.8A vulnerability, which was classified as critical, was found in Tenda AC8 16.03.34.06. Affected is the function formGetRouterStatus of the f CVE-2025-43695.5The Companion Auto Update plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘update_delay_days’ parameter in all ver CVE-2025-436977.5Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (DataMapper) allows exposure of encrypted data. This impacts Omn CVE-2025-436989.1Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of field level security controls for S CVE-2025-436995.3Client-Side Enforcement of Server-Side Security vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of required permission chec