CVE-2026-55871
GYM One is open-source gym management software for fitness centers, personal trainers, and sports…
- Risk score
- 44/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 15 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php concatenates the search_name and search_email GET parameters into both the user-list query and the COUNT query used for pagination without prepared statements. An aut…
- Affected
- See advisory
- Fix
- Upgrade the product to 1.4.1 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.5 medium
References
- https://github.com/mayerbalintdev/GYM-One/commit/d3a0cf134f0ab3ac12aee7dca283b93c4290dcc4
- https://github.com/mayerbalintdev/GYM-One/releases/tag/V1.4.1
- https://github.com/mayerbalintdev/GYM-One/security/advisories/GHSA-9j4g-cq35-8997
- https://github.com/mayerbalintdev/GYM-One/security/advisories/GHSA-9j4g-cq35-8997
Original description
GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php concatenates the search_name and search_email GET parameters into both the user-list query and the COUNT query used for pagination without prepared statements. An authenticated administrator can inject SQL through either search field to read data from arbitrary tables, including user information and password hashes. Depending on database permissions, the same injection may also permit filesystem writes. This issue is fixed in version 1.4.1.
Last activity 15 Oct 2026. Patch Forecast updates every hour.