Reflected Cross-Site Scripting Vulnerability in IsMyGym by Zuinq Studio
CVE-2025-41081

5.1MEDIUM

Key Information:

Vendor: Zuinq Studio
Status: Ismygym
Vendor: CVE Published:; 20 January 2026

🔔 Create Zuinq Studio Vulnerability Alert

What is CVE-2025-41081?

A reflected cross-site scripting (XSS) vulnerability exists in IsMyGym, allowing attackers to execute malicious JavaScript code in a victim's web browser. By crafting a harmful URL containing '/.php/', an attacker can manipulate victims into clicking links that ultimately lead to unauthorized actions or access to sensitive information, such as session cookies. This poses significant risks to user data and security, making it crucial for users to address the vulnerability.

Affected Version(s)

IsMyGym all versions

References

https://www.incibe.es/en/incibe-cert/notices/aviso/reflec...

CVSS V4

Score:

5.1

Severity:

MEDIUM

Confidentiality:

None

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

Unknown

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jan 20, 2026
Vulnerability Reserved
Apr 16, 2025

Credit

Gonzalo Aguilar García (6h4ack)

CVE-2025-41081 Data

JSON