Is there a public PoC exploit available for CVE-2025-11591?

Yes, a public proof-of-concept exploit is available for CVE-2025-11591. Prioritise patching immediately. EPSS: 0.0%.

CodeAstro Gym Management System CVE-2025-11591

Q: What is the CVSS score of CVE-2025-11591?

CVE-2025-11591 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-10-11 cna@vuldb.com

PHP SQLi Gym Management System

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 02:15 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in CodeAstro Gym Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/actions/delete-member.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

SQL injection in CodeAstro Gym Management System 1.0 allows authenticated remote attackers to manipulate the ID parameter in /admin/actions/delete-member.php, enabling unauthorized database queries with limited confidentiality and integrity impact. The vulnerability requires valid administrative credentials and carries a CVSS score of 2.1 with low confidentiality and integrity impact but no availability risk. Publicly available exploit code exists, though real-world exploitation remains extremely limited based on a 0.03% EPSS score.

Technical ContextAI

The vulnerability is a SQL injection flaw (CWE-74) in a PHP-based gym management system's administrative member deletion endpoint. The issue stems from insufficient input validation on the ID parameter passed to /admin/actions/delete-member.php, allowing an attacker to inject arbitrary SQL commands into database queries. The affected product is CodeAstro Gym Management System version 1.0, a niche administrative management application. SQL injection in this context is constrained by the CVSS vector (PR:L - requires authenticated login, VC:L/VI:L - low confidentiality and integrity impact, VA:L - no availability impact), suggesting the injection is either filtered to read-only queries or sandboxed within the scope of member-related data.

RemediationAI

Apply a security patch from CodeAstro if available by visiting https://codeastro.com/ to check for updates beyond version 1.0. If no patched version is available, implement input validation on the ID parameter using parameterized queries (prepared statements) in /admin/actions/delete-member.php to prevent SQL injection; this requires code review and patching by the vendor. As a compensating control, restrict network access to the /admin directory using Web Application Firewall (WAF) rules or reverse proxy authentication to allow only trusted administrative IP ranges, reducing the attack surface. This mitigates the requirement for an attacker to have legitimate administrative credentials. Additionally, enable SQL query logging and rate-limiting on the delete-member endpoint to detect exploitation attempts. Contact CodeAstro support directly for patch availability status.