CVE-2026-4316: Reflected Cross-Site Scripting in software IsMyGym by Zuinq Studio

Published Oct 26, 2026

Updated

Reflected Cross-Site Scripting (XSS) in Gym Management Software IsMyGym by Zuinq Studio affecting the reservation endpoint where the 'ret' parameter is reflected in the HTTP response without any proper sanitization. Successfull explotation of this vulnerability could allow an attacker to inject arbitrary JavaScript code executed in the context of the victim’s browser.

Affected Software

1 affected component

Zuinq Studio IsMyGym

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IsMyGym to a version that resolves this vulnerability.
Fixed in 6.0.85

Event History

Oct 26, 2026

CVE Published

via MITRE·09:47 AM

Data Sourced

via MITRE·09:47 AM

RemedyDescriptionWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attacker needs to cause a victim to access a crafted request to the reservation endpoint containing a malicious value in the ret parameter. The injected JavaScript then executes in the victim's browser in the application's context.

Who is exposed to this vulnerability?

Users of the IsMyGym reservation functionality are exposed if they can be induced to open a maliciously crafted reservation-endpoint request. The provided information does not identify affected versions, configuration prerequisites, or authentication requirements.

CVE-2026-4316: Reflected Cross-Site Scripting in software IsMyGym by Zuinq Studio

Affected Software

Remediation

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Who is exposed to this vulnerability?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Who is exposed to this vulnerability?