{"id":"CVE-2026-124637","kind":"vulnerability","aliases":["CVE-2026-124637"],"related":[],"title":"Luxor Gym Tarrega profile form: stored XSS lets scripts run in browsers","description":"A stored Cross-Site Scripting (XSS) vulnerability was identified in the profile editing form, in the parameters: cliNom and cliCognoms, in a request to https://www.luxorgymtarrega.com/dadespersonals/modificarClient/ID. User-provided data is neither validated nor escaped before being displayed in the HTML response and stored in the database, allowing arbitrary JavaScript code to be executed in the victim’s browser.","summary":"The profile editing form at luxorgymtarrega.com does not validate or escape the cliNom and cliCognoms fields before storing and displaying them. An attacker can save JavaScript in their profile that runs in the browser of anyone who views it.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["luxor-gym-tarrega","other","web-application"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-09T10:17:09+00:00","first_seen_at":"2026-11-09T10:25:49+00:00","triaged_at":"2026-11-09T10:26:27+00:00","updated_at":"2026-11-09T10:26:27+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-09T10:26:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Luxor Gym Tarrega profile form: stored XSS lets scripts run in browsers","impact":"medium","summary":"The profile editing form at luxorgymtarrega.com does not validate or escape the cliNom and cliCognoms fields before storing and displaying them. An attacker can save JavaScript in their profile that runs in the browser of anyone who views it.","audience":"businesses","category":"other","nicknames":[],"who_cares":["web-application","luxor-gym-tarrega"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker script runs in victims' browsers, stealing sessions or data","analyst_note":"Confirm the vendor and whether the site has a patch; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-124637 for any fix or affected versions.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Only the Luxor Gym Tarrega website at luxorgymtarrega.com, as described by the NVD entry, is named. Anyone who views a stored profile in the affected form could have script run in their browser. The sources do not name a product version or a fix.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000704,"input_tokens":4605,"output_tokens":486,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124637':15A,18A '-2026':14A,17A '/dadespersonals/modificarclient/id.':92C 'allow':114C 'anyon':62B 'applic':26B 'arbitrari':115C 'attack':49B 'browser':12A,60B,125C 'clicognom':41B,85C 'clinom':39B,83C 'code':117C 'cross':68C 'cross-sit':67C 'cve':13A,16A 'data':96C 'databas':113C 'display':46B,104C 'edit':29B,78C 'escap':37B,101C 'execut':120C 'field':42B 'form':5A,30B,79C 'gym':2A,21B 'html':107C 'identifi':74C 'javascript':52B,116C 'let':8A 'luxor':1A,20B 'luxor-gym-tarrega':19B 'luxorgymtarrega.com':32B 'neither':98C 'paramet':82C 'profil':4A,28B,55B,77C 'provid':95C 'request':88C 'respons':108C 'run':10A,57B 'save':51B 'script':9A,70C 'site':69C 'store':6A,44B,66C,110C 'tarrega':3A,22B 'user':94C 'user-provid':93C 'valid':35B,99C 'victim':123C 'view':64B 'vulner':72C 'web':25B 'web-appl':24B 'www.luxorgymtarrega.com':91C 'www.luxorgymtarrega.com/dadespersonals/modificarclient/id.':90C 'xss':7A,71C","nicknames":[],"mitigations":[],"who_affected":"Only the Luxor Gym Tarrega website at luxorgymtarrega.com, as described by the NVD entry, is named. Anyone who views a stored profile in the affected form could have script run in their browser. The sources do not name a product version or a fix.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["luxorgymtarrega","medium","other","webapplication"],"campaign_type":null,"search_a":"'-124637':15A,18A '-2026':14A,17A 'browser':12A 'cve':13A,16A 'form':5A 'gym':2A 'let':8A 'luxor':1A 'profil':4A 'run':10A 'script':9A 'store':6A 'tarrega':3A 'xss':7A","search_b":"'anyon':62B 'applic':26B 'attack':49B 'browser':60B 'clicognom':41B 'clinom':39B 'display':46B 'edit':29B 'escap':37B 'field':42B 'form':30B 'gym':21B 'javascript':52B 'luxor':20B 'luxor-gym-tarrega':19B 'luxorgymtarrega.com':32B 'profil':28B,55B 'run':57B 'save':51B 'store':44B 'tarrega':22B 'valid':35B 'view':64B 'web':25B 'web-appl':24B","search_c":"'/dadespersonals/modificarclient/id.':92C 'allow':114C 'arbitrari':115C 'browser':125C 'clicognom':85C 'clinom':83C 'code':117C 'cross':68C 'cross-sit':67C 'data':96C 'databas':113C 'display':104C 'edit':78C 'escap':101C 'execut':120C 'form':79C 'html':107C 'identifi':74C 'javascript':116C 'neither':98C 'paramet':82C 'profil':77C 'provid':95C 'request':88C 'respons':108C 'script':70C 'site':69C 'store':66C,110C 'user':94C 'user-provid':93C 'valid':99C 'victim':123C 'vulner':72C 'www.luxorgymtarrega.com':91C 'www.luxorgymtarrega.com/dadespersonals/modificarclient/id.':90C 'xss':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T10:17:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cve-coordination@incibe.es","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124637","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124637","severity":null,"published_at":"2026-11-09T10:17:09+00:00","modified_at":"2026-11-09T10:17:09+00:00","first_seen_at":"2026-11-09T10:25:49+00:00","fetched_at":"2026-11-09T10:25:49+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}