Maksisoft Gym
Monthly
Account enumeration in Maksisoft Gym 0.5.10 (and later 0.5.x builds short of 0.5.11) lets unauthenticated remote attackers determine which usernames or email addresses correspond to real accounts by observing inconsistent responses from login, registration, or password-reset endpoints. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N scores 5.3, reflecting a network-reachable, no-authentication, no-interaction information-disclosure issue with confidentiality-only, low-severity impact - there is no direct account takeover, integrity, or availability effect. No public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (not in CISA KEV); real-world exposure is further limited by the small, regionally concentrated deployment base and by the attacker's need to supply candidate identifiers to test.
Account enumeration in Maksisoft Gym 0.5.10 (and later 0.5.x builds short of 0.5.11) lets unauthenticated remote attackers determine which usernames or email addresses correspond to real accounts by observing inconsistent responses from login, registration, or password-reset endpoints. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N scores 5.3, reflecting a network-reachable, no-authentication, no-interaction information-disclosure issue with confidentiality-only, low-severity impact - there is no direct account takeover, integrity, or availability effect. No public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (not in CISA KEV); real-world exposure is further limited by the small, regionally concentrated deployment base and by the attacker's need to supply candidate identifiers to test.