CVE-2024-55271

체육관 관리 시스템 CVE-2024-55271 PHP와 MySQL로 구축된 체육관 관리 시스템입니다. 감사자 Shoaib Alam - LinkedIn 프로필 설명 프로필 업데이트 섹션의 CSRF 취약점 체육관 관리 시스템에서 교차 사이트 요청 위조CSRF 취약점이 확인되었습니다. 이 문제는 사용자 패널의 프로필 업데이트 기능에 존재합니다. 이 애플리케이션은 현재 Anti-CSRF 토큰을 구현하지 않아 교차 사이트 요청 위조CSRF 공격에 취약합니다. 이 보안 취약점은 특히 /profile.php 엔드포인트에 영향을 미칩니다...

wger: Privilege escalation via trainer-login session chaining allows gym trainer to impersonate gym manager

SummaryA gym trainer can escalate their session to any higher-privileged account gym manager, general manager by chaining two calls to the trainer-login endpoint. Once a trainer performs a legitimate switch into a low-privileged user, the session flag trainer.identityis set and this flag alone...

CVE-2026-7716

A vulnerability was found in code-projects Gym Management System In PHP and Windows NT 1.0. This vulnerability affects unknown code of the file /index.php. Performing a manipulation of the argument day results in sql injection. The attack can be initiated remotely. The exploit has been made publi...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the authorization process in UserDeactivateView, UserActivateView, and delete in wger/core/views/user.py due to improper gym-scope checks when both the attacker and victim have gym=None. An attacker with the...

CVE-2026-7716

A vulnerability was found in code-projects Gym Management System In PHP and Windows NT 1.0. This vulnerability affects unknown code of the file /index.php. Performing a manipulation of the argument day results in sql injection. The attack can be initiated remotely. The exploit has been made publi...

CVE-2026-7716 code-projects Gym Management System In PHP/Windows NT index.php sql injection

A vulnerability was found in code-projects Gym Management System In PHP and Windows NT 1.0. This vulnerability affects unknown code of the file /index.php. Performing a manipulation of the argument day results in sql injection. The attack can be initiated remotely. The exploit has been made publi...

CVE-2026-7716

CVE-2026-7716 describes an SQL injection in the Gym Management System (code-projects) for PHP on Windows NT 1.0, via manipulation of the day parameter in /index.php. The exact vulnerable component and file are /index.php; the root cause is improper handling of user input leading to SQL injection....

EUVD-2026-26867

A vulnerability was found in code-projects Gym Management System In PHP and Windows NT 1.0. This vulnerability affects unknown code of the file /index.php. Performing a manipulation of the argument day results in sql injection. The attack can be initiated remotely. The exploit has been made publi...

CVE-2026-7716 code-projects Gym Management System In PHP/Windows NT index.php sql injection

A vulnerability was found in code-projects Gym Management System In PHP and Windows NT 1.0. This vulnerability affects unknown code of the file /index.php. Performing a manipulation of the argument day results in sql injection. The attack can be initiated remotely. The exploit has been made publi...

CVE-2026-7716

A vulnerability was found in code-projects Gym Management System In PHP and Windows NT 1.0. This vulnerability affects unknown code of the file /index.php. Performing a manipulation of the argument day results in sql injection. The attack can be initiated remotely. The exploit has been made publi...

PT-2026-36744

Name of the Vulnerable Software and Affected Versions Gym Management System In PHP and Windows NT 1.0 affected versions not specified Description A remote SQL injection can be triggered through the manipulation of the day argument in the '/index.php' endpoint. SQL injection is a type of flaw that...

CVE-2026-7716: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in code-projects Gym Management System In PHP and Windows NT 1.0. This vulnerability affects unknown code of the file /index.php. Performing a manipulation of the argument day results in sql injection. The attack can be initiated remotely. The exploit has been made publi...

CVE-2026-7553

A vulnerability was found in code-projects Gym Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/editexercises.php. The manipulation of the argument editexercise results in sql injection. It is possible to launch the attack remotely. The exploit...

CVE-2026-7553 code-projects Gym Management System edit_exercises.php sql injection

A vulnerability was found in code-projects Gym Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/editexercises.php. The manipulation of the argument editexercise results in sql injection. It is possible to launch the attack remotely. The exploit...

CVE-2026-7553

A vulnerability was found in code-projects Gym Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/editexercises.php. The manipulation of the argument editexercise results in sql injection. It is possible to launch the attack remotely. The exploit...

CVE-2026-7553 code-projects Gym Management System edit_exercises.php sql injection

A vulnerability was found in code-projects Gym Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/editexercises.php. The manipulation of the argument editexercise results in sql injection. It is possible to launch the attack remotely. The exploit...

EUVD-2026-26478

A vulnerability was found in code-projects Gym Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/editexercises.php. The manipulation of the argument editexercise results in sql injection. It is possible to launch the attack remotely. The exploit...

CVE-2026-7553

CVE-2026-7553 affects code-projects Gym Management System 1.0. The vulnerability resides in the file /admin/edit_exercises.php where manipulation of the argument edit_exercise enables a SQL injection. The issue is exploitable remotely and an exploit has been made public (Exploit maturity: PROOF-O...

CVE-2026-7553: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in code-projects Gym Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/editexercises.php. The manipulation of the argument editexercise results in sql injection. It is possible to launch the attack remotely. The exploit...

PT-2026-36298

A vulnerability was found in code-projects Gym Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/edit exercises.php. The manipulation of the argument edit exercise results in sql injection. It is possible to launch the attack remotely. The exploi...