EUVD-2025-18846Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious CSRF payload
-
DeliveryDeliver via email/link
-
ExploitVictim clicks while authenticated
-
ExecutionExecute unauthorized action
-
ImpactImpact on data integrity
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V3 - Web Frontend Security Anti-CSRF tokens, SameSite cookies
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must trick an authenticated admin user into clicking a crafted link or visiting a malicious page while logged into the Gym Management System. No special configuration is required; the vulnerability exists in the default deployment. Limiting factor: requires user interaction (UI:P) and the victim must be authenticated. |
| Impact | CVSS 4.0 base score is 2.1 (Low) with vector AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N, indicating low impact. EPSS score is 0.08% (24th percentile), suggesting low exploitation probability. No KEV listing. Public exploit exists but no active exploitation confirmed. SSVC decision: exploitation status 'none', automatable 'yes' (CSRF can be automated), technical impact 'partial'. Overall risk is low; the high CVSS score is not present, and real-world risk is minimal due to low impact and low exploitation likelihood. |
| Exploit ScenarioDerived | An attacker crafts a malicious link or form that, when clicked by an authenticated admin, performs an action like changing settings or deleting data. Since a public exploit exists, the attack can be easily replicated. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 26, 2026
Cross-site request forgery in SourceCodester Gym Management System 1.0 allows an attacker to perform unauthorized actions on behalf of an authenticated admin. A publicly available exploit exists, but no active exploitation has been confirmed. The EPSS score is low (0.08%), indicating low exploitation likelihood.
Earlier versions of this analysis (1)
RemediationAI
Upgrade to a patched version if available; otherwise, implement CSRF tokens in all state-changing requests. As a workaround, ensure same-site cookie attributes are set and validate the Referer header. Note that these mitigations may require code changes and could affect functionality. No official patch version has been identified.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a Cross-Site Request Forgery (CSRF) classified under CWE-352. CSRF attacks exploit the trust a web application has in an authenticated user's browser, tricking the victim into executing unwanted actions. The affected product is SourceCodester Gym Management System version 1.0, identified by CPE cpe:2.3:a:oretnom23:gym_management_system:1.0. The exact vulnerable function is unknown, but the manipulation leads to CSRF.
Know when Gym Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Network attack vector, low complexity, no privileges, user interaction required, low integrity impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was found in SourceCodester Gym Management System 1.0. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
Organizations using A vulnerability should be aware of moderate risk from CVE-2025-6476, a cross-site request forgery vulnerability rated CVSS 4.3. Users could be tricked into performing unintended actions. Proof-of-concept code is publicly available. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: implement SameSite cookie attributes and anti-CSRF tokens.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
More in Gym Management System
View allCode-Projects Gym Management System V1.0 allows remote attackers to execute arbitrary SQL commands via the login form, l
A vulnerability classified as critical has been found in SourceCodester Gym Management System. Rated critical severity (
A vulnerability was found in SourceCodester Gym Management System. Rated critical severity (CVSS 9.8), this vulnerabilit
A vulnerability was found in SourceCodester Gym Management System. Rated critical severity (CVSS 9.8), this vulnerabilit
A vulnerability, which was classified as critical, was found in SourceCodester Gym Management System. Rated critical sev
An SQL injection vulnerability was discovered in Gym Management System In manage_user.php file, GET parameter 'id' is vu
GYM-MANAGEMENT-SYSTEM 1.0 has multiple SQL injection vulnerabilities in search and payment endpoints (member_search, tra
A vulnerability was found in SourceCodester Gym Management System. Rated high severity (CVSS 8.8), this vulnerability is
A vulnerability was found in SourceCodester Gym Management System. Rated high severity (CVSS 8.8), this vulnerability is
A vulnerability classified as critical has been found in SourceCodester Gym Management System. Rated high severity (CVSS
A vulnerability was found in itsourcecode Gym Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerabilit
A vulnerability was found in itsourcecode Gym Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerabilit
Exploit-DB