Multiple SQL injection vulnerabilities discovered in AbhishekMali21 GYM-MANAGEMENT-SYSTEM version 1.0. Four separate vulnerabilities affect search functionality through the 'name' parameter in member_search.php, trainer_search.php, and gym_search.php files, and the 'id' parameter in payment_search.php. These vulnerabilities allow unauthenticated remote attackers to inject malicious SQL commands. Successful exploitation can lead to unauthorized data extraction, authentication bypass, and modification of database contents. The vulnerabilities pose a significant risk as they require no authentication to exploit.