{"id":"CVE-2026-4316","kind":"vulnerability","aliases":["CVE-2026-4316"],"related":[],"title":"IsMyGym gym software: reflected XSS in reservation page","description":"Reflected Cross-Site Scripting (XSS) in Gym Management Software IsMyGym by Zuinq Studio affecting the reservation endpoint where the 'ret' parameter is reflected in the HTTP response without any proper sanitization. Successfull explotation of this vulnerability could allow an attacker to inject arbitrary JavaScript code executed in the context of the victim’s browser.","summary":"The IsMyGym gym management software by Zuinq Studio reflects the 'ret' parameter of its reservation endpoint into the HTTP response without sanitization. An attacker can craft a link that runs arbitrary JavaScript in a victim's browser.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gym-management","other","web"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-26T10:16:53+00:00","first_seen_at":"2026-10-26T10:29:17+00:00","triaged_at":"2026-10-26T10:30:58+00:00","updated_at":"2026-10-26T10:30:58+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-26T10:30:58Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IsMyGym gym software: reflected XSS in reservation page","impact":"medium","summary":"The IsMyGym gym management software by Zuinq Studio reflects the 'ret' parameter of its reservation endpoint into the HTTP response without sanitization. An attacker can craft a link that runs arbitrary JavaScript in a victim's browser.","category":"other","nicknames":[],"who_cares":["gym-management","web"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs JavaScript in a victim's browser session on the gym site","analyst_note":"Check the NVD entry and the vendor for affected versions, the fixed release and whether the reservation endpoint is hosted by Zuinq or self-hosted.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000514,"input_tokens":3362,"output_tokens":356,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':10A,13A '-4316':11A,14A 'affect':71C 'allow':95C 'arbitrari':50B,100C 'attack':43B,97C 'browser':56B,111C 'code':102C 'context':106C 'could':94C 'craft':45B 'cross':59C 'cross-sit':58C 'cve':9A,12A 'endpoint':35B,74C 'execut':103C 'explot':90C 'gym':2A,16B,22B,64C 'gym-manag':15B 'http':38B,83C 'inject':99C 'ismygym':1A,21B,67C 'javascript':51B,101C 'link':47B 'manag':17B,23B,65C 'page':8A 'paramet':31B,78C 'proper':87C 'reflect':4A,28B,57C,80C 'reserv':7A,34B,73C 'respons':39B,84C 'ret':30B,77C 'run':49B 'sanit':41B,88C 'script':61C 'site':60C 'softwar':3A,24B,66C 'studio':27B,70C 'successful':89C 'victim':54B,109C 'vulner':93C 'web':19B 'without':40B,85C 'xss':5A,62C 'zuinq':26B,69C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T10:16:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cve-coordination@incibe.es","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-4316","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4316","severity":null,"published_at":"2026-10-26T10:16:53+00:00","modified_at":"2026-10-26T10:16:53+00:00","first_seen_at":"2026-10-26T10:29:17+00:00","fetched_at":"2026-10-26T10:29:17+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}