Skip to content
OpenAdvisories
Medium · 5.1 CVE-2025-41081 EUVD-2026-3445GHSA-4p29-qhc7-mxqr

Reflected Cross-Site Scripting (XSS) in IsMyGym

Published Jan 20, 2026 · Updated Feb 26, 2026 · Assigned by INCIBE

Description

Reflected Cross-Site Scripting (XSS) vulnerability in IsMyGym by Zuinq Studio. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL with '/<PATH>.php/<XSS>'. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.

Affected products

VendorProductAffectedFixed
Zuinq Studio IsMyGym all versions —

References