CVE-2026-124637 · Other
NO FIX YET
The profile editing form at luxorgymtarrega.com does not validate or escape the cliNom and cliCognoms fields before storing and displaying them. An attacker can save JavaScript in their profile that runs in the browser of anyone who views it.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only the Luxor Gym Tarrega website at luxorgymtarrega.com, as described by the NVD entry, is named. Anyone who views a stored profile in the affected form could have script run in their browser. The sources do not name a product version or a fix.
Who cares luxor-gym-tarrega, web-application
Unknown from the sources.
No fix yet, per the sources.
A stored Cross-Site Scripting (XSS) vulnerability was identified in the profile editing form, in the parameters: cliNom and cliCognoms, in a request to https://www.luxorgymtarrega.com/dadespersonals/modificarClient/ID. User-provided data is neither validated nor escaped before being displayed in the HTML response and stored in the database, allowing arbitrary JavaScript code to be executed in the victim’s browser.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.