Gym One
Monthly
Stored cross-site scripting in GYM One (all releases prior to 1.4.1) lets an attacker who can write to a user record's firstname, lastname, or email profile fields inject persistent JavaScript that executes in an administrator's browser whenever the administrator opens the user-management page at /admin/users/. Because the injected payload is rendered in the administrator's session, it can read or act on administrator-session data and perform privileged actions with the victim's rights until the poisoned record is removed; the CVSS 3.1 vector scores 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), reflecting the required low-privilege write access and the administrator's page visit as a user-interaction prerequisite, with scope change since the low-privileged author gains the administrator's privileges. The issue is fixed in version 1.4.1 per the vendor advisory and release tag, and no public exploit code was identified at time of analysis.
SQL injection in GYM One's administrative user-search endpoint (admin/users/index.php) allows an authenticated administrator to read arbitrary database tables - including user records and password hashes - and, where the underlying database account holds elevated privileges such as MySQL's FILE privilege, to write files onto the server filesystem. The flaw affects all GYM One releases prior to 1.4.1 and is reachable remotely through the search_name and search_email GET parameters, though it requires a valid administrator session (PR:H), which confines realistic exploitation to insiders or attackers who have already compromised an admin account. There is no public exploit identified at time of analysis, no indication of confirmed active exploitation (CISA KEV), and the vendor has released a fixed version, 1.4.1, so risk is best characterized as moderate and access-gated rather than urgent and broadly exploitable.
Stored cross-site scripting in GYM One (all releases prior to 1.4.1) lets an attacker who can write to a user record's firstname, lastname, or email profile fields inject persistent JavaScript that executes in an administrator's browser whenever the administrator opens the user-management page at /admin/users/. Because the injected payload is rendered in the administrator's session, it can read or act on administrator-session data and perform privileged actions with the victim's rights until the poisoned record is removed; the CVSS 3.1 vector scores 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), reflecting the required low-privilege write access and the administrator's page visit as a user-interaction prerequisite, with scope change since the low-privileged author gains the administrator's privileges. The issue is fixed in version 1.4.1 per the vendor advisory and release tag, and no public exploit code was identified at time of analysis.
SQL injection in GYM One's administrative user-search endpoint (admin/users/index.php) allows an authenticated administrator to read arbitrary database tables - including user records and password hashes - and, where the underlying database account holds elevated privileges such as MySQL's FILE privilege, to write files onto the server filesystem. The flaw affects all GYM One releases prior to 1.4.1 and is reachable remotely through the search_name and search_email GET parameters, though it requires a valid administrator session (PR:H), which confines realistic exploitation to insiders or attackers who have already compromised an admin account. There is no public exploit identified at time of analysis, no indication of confirmed active exploitation (CISA KEV), and the vendor has released a fixed version, 1.4.1, so risk is best characterized as moderate and access-gated rather than urgent and broadly exploitable.