CVE-2025-41081 in IsMyGym

Riassunto

di MITRE • 20/01/2026

Reflected Cross-Site Scripting (XSS) vulnerability in IsMyGym by Zuinq Studio. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL with '/<PATH>.php/<XSS>'. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

• Responsabile: INCIBE
• Prenotare: 16/04/2025
• Divulgazione: 20/01/2026
• Moderazione: accettato
• Voce: VDB-341934
• CPE: pronto
• CWE: CWE-79 (confermato)
• CVSS: 4.3 (VulDB)
• EPSS: 0.00272
• KEV: no
• Attività: molto basso

Fonti

• MITRE: https://www.cve.org/CVERecord?id=CVE-2025-41081
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-41081
• CVE Details: https://www.cvedetails.com/cve/CVE-2025-41081/