Live › vulnerability › CVE-2026-4316
Go to dashboardThe IsMyGym gym management software by Zuinq Studio reflects the 'ret' parameter of its reservation endpoint into the HTTP response without sanitization. An attacker can craft a link that runs arbitrary JavaScript in a victim's browser.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 10:29 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Reflected Cross-Site Scripting (XSS) in Gym Management Software IsMyGym by Zuinq Studio affecting the reservation endpoint where the 'ret' parameter is reflected in the HTTP response without any proper sanitization. Successfull explotation of this vulnerability could allow an attacker to inject arbitrary JavaScript code executed in the context of the victim’s browser.
This page as .md · .json · in your agent: get_signal("CVE-2026-4316")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.