CVE-2026-4316

UNKNOWN 0.0

Reflected Cross-Site Scripting in software IsMyGym by Zuinq Studio

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Reflected Cross-Site Scripting (XSS) in Gym Management Software IsMyGym by Zuinq Studio affecting the reservation endpoint where the 'ret' parameter is reflected in the HTTP response without any proper sanitization. Successfull explotation of this vulnerability could allow an attacker to inject arbitrary JavaScript code executed in the context of the victim’s browser.

CWE	CWE-79
Vendor	zuinq studio
Product	ismygym
Published	Oct 26, 2026

Stay Ahead of the Next One

Get instant alerts for zuinq studio ismygym

Be the first to know when new unknown vulnerabilities affecting zuinq studio ismygym are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Zuinq Studio / IsMyGym

versions prior to v6.0.85

References

NVD ↗ CVE.org ↗ EPSS Data ↗

incibe.es: https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-software-ismygym-zuinq-studio

Credits

Gonzalo Aguilar García (6h4ack)