CVE-2025-41081: Reflected Cross-Site Scripting (XSS) in IsMyGym

Published Jan 20, 2026

Updated

Reflected Cross-Site Scripting (XSS) vulnerability in IsMyGym by Zuinq Studio. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL with '/<PATH>.php/<XSS>'. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.

Affected Software

1 affected component

Zuinq Studio IsMyGym

Remediation

Information

The vulnerability has been fixed by Zuinq Studio's team in the latest version.

Event History

Jan 20, 2026

CVE Published

via MITRE·12:11 PM

Data Sourced

via MITRE·12:11 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·01:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-41081?

The severity of CVE-2025-41081 is considered to be medium due to the potential for executing malicious JavaScript in the victim's browser.

How do I fix CVE-2025-41081?

To fix CVE-2025-41081, sanitize and encode user inputs to prevent the execution of reflected XSS attacks.

Who is affected by CVE-2025-41081?

The CVE-2025-41081 vulnerability affects users of the IsMyGym application by Zuinq Studio.

What type of attack does CVE-2025-41081 enable?

CVE-2025-41081 enables reflected Cross-Site Scripting (XSS) attacks, allowing malicious code execution in the victim’s browser.

What impact could CVE-2025-41081 have on users?

Users impacted by CVE-2025-41081 may face data theft, session hijacking, or other malicious activities due to executing malicious scripts.