---
id: "CVE-2026-4316"
kind: "vulnerability"
aliases: ["CVE-2026-4316"]
title: "IsMyGym gym software: reflected XSS in reservation page"
severity: "medium"
cvss: 5.1
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["gym-management", "other", "web"]
not_affected_if: []
published_at: "2026-10-26T10:16:53+00:00"
first_seen_at: "2026-10-26T10:29:17+00:00"
updated_at: "2026-10-26T10:30:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4316", "first_seen_at": "2026-10-26T10:29:17+00:00"}]
---

# IsMyGym gym software: reflected XSS in reservation page

The IsMyGym gym management software by Zuinq Studio reflects the 'ret' parameter of its reservation endpoint into the HTTP response without sanitization. An attacker can craft a link that runs arbitrary JavaScript in a victim's browser.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-26T10:29:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-4316

## From the sources

Reflected Cross-Site Scripting (XSS) in Gym Management Software IsMyGym by Zuinq Studio affecting the reservation endpoint where the 'ret' parameter is reflected in the HTTP response without any proper sanitization. Successfull explotation of this vulnerability could allow an attacker to inject arbitrary JavaScript code executed in the context of the victim’s browser.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_