CVE-2026-55872

GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php renders the stored firstname, lastname, and email profile fields into the administrator user list without HTML output encoding. An attacker who...

CVE-2026-55871

GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php concatenates the searchname and searchemail GET parameters into both the user-list query and the COUNT query used for pagination without prepare...

CVE-2026-55872 GYM One admin user list is vulnerable to stored cross-site scripting

GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php renders the stored firstname, lastname, and email profile fields into the administrator user list without HTML output encoding. An attacker who...

CVE-2026-55872 GYM One admin user list is vulnerable to stored cross-site scripting

GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php renders the stored firstname, lastname, and email profile fields into the administrator user list without HTML output encoding. An attacker who...

CVE-2026-55872

GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php renders the stored firstname, lastname, and email profile fields into the administrator user list without HTML output encoding. An attacker who...

EUVD-2026-102308

GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php renders the stored firstname, lastname, and email profile fields into the administrator user list without HTML output encoding. An attacker who...

CVE-2026-55872 GYM One admin user list is vulnerable to stored cross-site scripting

GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php renders the stored firstname, lastname, and email profile fields into the administrator user list without HTML output encoding. An attacker who...

CVE-2026-55872

The open-source gym management software GYM One is vulnerable to stored cross-site scripting (XSS) in versions prior to 1.4.1 . The root cause is the lack of HTML output encoding when the admin/users/index.php page renders the firstname , lastname , and email profile fields into the administrator...

CVE-2026-55871 GYM One: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in admin/users/index.php

GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php concatenates the searchname and searchemail GET parameters into both the user-list query and the COUNT query used for pagination without prepare...

CVE-2026-55871

The GYM One gym management software is vulnerable to SQL Injection in the admin/users/index.php component in versions prior to 1.4.1 . The flaw exists because the search_name and search_email GET parameters are concatenated into the user-list and COUNT queries without using prepared statements . ...

EUVD-2026-102307

GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php concatenates the searchname and searchemail GET parameters into both the user-list query and the COUNT query used for pagination without prepare...

CVE-2026-55871 GYM One: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in admin/users/index.php

GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php concatenates the searchname and searchemail GET parameters into both the user-list query and the COUNT query used for pagination without prepare...

CVE-2026-55871 GYM One: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in admin/users/index.php

GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php concatenates the searchname and searchemail GET parameters into both the user-list query and the COUNT query used for pagination without prepare...

CVE-2026-55871

GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php concatenates the searchname and searchemail GET parameters into both the user-list query and the COUNT query used for pagination without prepare...

PT-2026-115206

GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php renders the stored firstname, lastname, and email profile fields into the administrator user list without HTML output encoding. An attacker who...

PT-2026-115205

GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php concatenates the search name and search email GET parameters into both the user-list query and the COUNT query used for pagination without...

CVE-2026-55872: Improper Neutralization of Input During Web Page Generation

GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php renders the stored firstname, lastname, and email profile fields into the administrator user list without HTML output encoding. An attacker who...

CVE-2026-55871: Improper Neutralization of Special Elements used in an SQL Command

GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php concatenates the searchname and searchemail GET parameters into both the user-list query and the COUNT query used for pagination without prepare...

Mayer Balint GYM One Cross-site Scripting Vulnerability

Mayer Balint GYM versions prior to 1.4.1 have a cross-site scripting vulnerability. This vulnerability arises from the fact that the admin/users/index.php file does not encode the stored firstname, lastname, and email fields using HTML. This may lead to a stored-cross-site scripting attack...

Mayer Balint GYM has a SQL injection vulnerability

Mayer Balint GYM versions prior to 1.4.1 have a SQL injection vulnerability. This vulnerability arises from the use of GET parameters for searchname and searchemail in the admin/users/index.php file. These parameters are concatenated with the COUNT queries for user list and pagination...