Reflected Cross-Site Scripting in software IsMyGym by Zuinq Studio
Gym Management Software, versions prior to v6.0.85.
INCIBE has coordinated the publication of a medium severity vulnerability affecting Gym Management Software IsMyGym by Zuinq Studio, software for managing sports centers, gyms, and trainers. The vulnerability was discovered by Gonzalo Aguilar García (6h4ack).
This vulnerability has been assigned the following code, CVSS v4.0 base score, CVSS vector and CWE vulnerability type:
- CVE-2026-4316: CVSS v4.0: 5.1 | CVSS AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N | CWE-79
The vulnerability has been fixed by Zuinq Studio team in version v6.0.85.
CVE-2026-4316: reflected Cross-Site Scripting (XSS) in Gym Management Software IsMyGym by Zuinq Studio affecting the reservation endpoint where the 'ret' parameter is reflected in the HTTP response without any proper sanitization. Successfull explotation of this vulnerability could allow an attacker to inject arbitrary JavaScript code executed in the context of the victim’s browser.
| Identificador CVE | Severidad | Explotación | Fabricante |
|---|---|---|---|
| CVE-2026-4316 | Media | No | Zuinq Studio |
