---
id: "CVE-2026-124637"
page: "https://infrastack.ai/live/CVE-2026-124637"
kind: "vulnerability"
aliases: ["CVE-2026-124637"]
title: "Luxor Gym Tarrega profile form: stored XSS lets scripts run in browsers"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["luxor-gym-tarrega", "other", "web-application"]
not_affected_if: []
published_at: "2026-11-09T10:17:09+00:00"
first_seen_at: "2026-11-09T10:25:49+00:00"
updated_at: "2026-11-09T10:26:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124637", "first_seen_at": "2026-11-09T10:25:49+00:00"}]
exploit_sources: []
---

# Luxor Gym Tarrega profile form: stored XSS lets scripts run in browsers

Link for people: https://infrastack.ai/live/CVE-2026-124637 (this .md is for agents)

The profile editing form at luxorgymtarrega.com does not validate or escape the cliNom and cliCognoms fields before storing and displaying them. An attacker can save JavaScript in their profile that runs in the browser of anyone who views it.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-09T10:25:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124637

## From the sources

A stored Cross-Site Scripting (XSS) vulnerability was identified in the profile editing form, in the parameters: cliNom and cliCognoms, in a request to https://www.luxorgymtarrega.com/dadespersonals/modificarClient/ID. User-provided data is neither validated nor escaped before being displayed in the HTML response and stored in the database, allowing arbitrary JavaScript code to be executed in the victim’s browser.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_