CVE-2025-10851: Campcodes Gym Management System ajax.php sql injection

Published Sep 23, 2025

Updated

A security flaw has been discovered in Campcodes Gym Management System 1.0. Impacted is an unknown function of the file /ajax.php?action=login. Performing manipulation of the argument Username results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited.

Affected Software

2 affected components

Campcodes Gym Management System

Campcodes Gym Management System=1.0

Event History

Sep 23, 2025

CVE Published

via MITRE·08:02 AM

Data Sourced

via MITRE·08:02 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-10851?

CVE-2025-10851 has a critical severity rating due to the potential for remote SQL injection attacks.

How do I fix CVE-2025-10851?

To fix CVE-2025-10851, sanitize and validate all user inputs, specifically for the Username parameter in the /ajax.php?action=login function.

What systems are affected by CVE-2025-10851?

CVE-2025-10851 affects Campcodes Gym Management System version 1.0.

Can CVE-2025-10851 be exploited remotely?

Yes, CVE-2025-10851 can be exploited remotely, allowing attackers to perform SQL injection attacks.

What type of vulnerability is CVE-2025-10851?

CVE-2025-10851 is classified as an SQL injection vulnerability.