Which versions of PHP are affected by CVE-2026-4550?

Organizations using code-projects Simple Gym Management System should be aware of moderate risk from CVE-2026-4550, a SQL injection vulnerability rated CVSS 4.7.

Is there a public PoC exploit available for CVE-2026-4550?

Yes, a public proof-of-concept exploit is available for CVE-2026-4550. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4550?

Within 30 days: Identify affected systems running code-projects Simple Gym Management System and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

PHP CVE-2026-4550

Q: What is the CVSS score of CVE-2026-4550?

CVE-2026-4550 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-14310 LOW

SQL Injection (CWE-89)

2026-03-22 VulDB

PHP SQLi Simple Gym Management System Code Projects

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.1 (MEDIUM) 2.0 (LOW)

CVSS changed

Apr 24, 2026 - 16:37 NVD

4.7 (MEDIUM) 5.1 (MEDIUM)

PoC Detected

Mar 23, 2026 - 16:16 vuln.today

Public exploit code

EUVD ID Assigned

Mar 22, 2026 - 14:00 euvd

EUVD-2026-14310

Analysis Generated

Mar 22, 2026 - 14:00 vuln.today

CVE Published

Mar 22, 2026 - 13:47 nvd

MEDIUM 4.7

DescriptionCVE.org

A vulnerability has been found in code-projects Simple Gym Management System up to 1.0. This affects an unknown part of the file /gym/func.php. Such manipulation of the argument Trainer_id/fname leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in Simple Gym Management System up to version 1.0 allows remote attackers with high privileges to manipulate the Trainer_id and fname parameters in /gym/func.php, enabling unauthorized database queries and potential data exfiltration or modification. Public exploit code exists for this vulnerability, and no patch is currently available.

Technical ContextAI

The vulnerability is a classic SQL injection (CWE-89) flaw in PHP-based web application code where user-supplied input from the Trainer_id and fname parameters is insufficiently sanitized before being incorporated into SQL queries. The affected product, identified via CPE cpe:2.3:a:code-projects:simple_gym_management_system:*:*:*:*:*:*:*:*, is a gym management system written in PHP that fails to use parameterized queries or adequate input validation. The disclosed exploits utilize time-based blind SQL injection techniques, meaning attackers can infer database structure and contents through timing delays in database responses, even without direct error messages.

RemediationAI

Immediate actions include: (1) Upgrade to a patched version if available from code-projects (check https://code-projects.org/ or contact the vendor directly, as no official patch advisory is referenced); (2) if patching is unavailable, implement parameterized queries (prepared statements) with bound parameters in /gym/func.php for all database interactions involving Trainer_id and fname; (3) enforce strict input validation using whitelisting and type-checking; (4) restrict administrative access to /gym/func.php endpoints to trusted IP ranges and require multi-factor authentication for admin accounts; (5) apply principle of least privilege to database accounts used by the application; (6) enable SQL query logging and monitoring to detect injection attempts. Interim network-level mitigations include deploying a Web Application Firewall (WAF) with rules to block common SQL injection patterns in the Trainer_id and fname parameters.