Ismygym
Monthly
Reflected cross-site scripting in the Zuinq Studio IsMyGym gym management software reservation endpoint lets remote attackers inject arbitrary JavaScript through the 'ret' parameter, which is echoed back in the HTTP response without sanitization. Rated 5.1 under CVSS 4.0 (assessed CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), the flaw requires the victim to actively open a crafted link, after which the script executes in that user's browser session with the privileges of that session. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the affected version range is not enumerated - the CPE is a wildcard covering all IsMyGym releases; INCIBE published the originating advisory.
Reflected cross-site scripting in the Zuinq Studio IsMyGym gym management software reservation endpoint lets remote attackers inject arbitrary JavaScript through the 'ret' parameter, which is echoed back in the HTTP response without sanitization. Rated 5.1 under CVSS 4.0 (assessed CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), the flaw requires the victim to actively open a crafted link, after which the script executes in that user's browser session with the privileges of that session. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the affected version range is not enumerated - the CPE is a wildcard covering all IsMyGym releases; INCIBE published the originating advisory.