IsMyGym EUVD-2026-109708

Exploitation requires an attacker to deliver a crafted link targeting the IsMyGym reservation endpoint with a payload in the 'ret' parameter, and the victim must actively open that link (UI:A) for the reflected script to execute - this is the primary limiting factor. No authentication is required of the attacker to craft the request (PR:N), but the payload runs only in the context of whichever user clicks it, so impact depends on that user's session. The description does not state any non-default configuration requirement; the specific affected versions are not identified in the provided data (CPE version is a wildcard).

This is a medium-severity reflected XSS (CVSS 4.0 base 5.1) in the IsMyGym reservation endpoint, where the 'ret' parameter is echoed into the response unsanitized. The CVSS 4.0 vector shows network reach and low complexity (AV:N/AC:L/AT:N) with no privileges required (PR:N), but exploitation is gated by active user interaction (UI:A) - the victim must follow an attacker-crafted link - and impact is limited to low confidentiality and integrity in the browser context (VC:L/VI:L, VA:N, no scope change to other systems). No EPSS score, KEV listing, or POC reference was supplied, so there is no signal of active or probable exploitation; the vuln.today decision label is 'this_month' rather than act_now/emergency. The signals are internally consistent - a reflected XSS requiring a user click in a niche product - so this reads as a genuine but moderate, non-urgent issue rather than a high-priority flaw. Missing data: no EPSS, no POC, and no fixed version are present in the provided sources.

An attacker crafts a URL to the IsMyGym reservation endpoint with a malicious payload in the 'ret' parameter and delivers it to a logged-in user (e.g., via email or chat). When the victim clicks, the reflected payload executes JavaScript in their browser in the application's context, enabling session/credential theft or actions on their behalf. No public exploit code was identified in the provided sources; exploitation requires the victim to open the crafted link (UI:A).