{"cve":"CVE-2026-55871","nvd":{"published":"2026-10-15T19:17:41.150","modified":"2026-10-16T20:04:29.760","status":"Deferred","description":"GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php concatenates the search_name and search_email GET parameters into both the user-list query and the COUNT query used for pagination without prepared statements. An authenticated administrator can inject SQL through either search field to read data from arbitrary tables, including user information and password hashes. Depending on database permissions, the same injection may also permit filesystem writes. This issue is fixed in version 1.4.1.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","score":6.5},"cwes":["CWE-89"],"references":["https://github.com/mayerbalintdev/GYM-One/commit/d3a0cf134f0ab3ac12aee7dca283b93c4290dcc4","https://github.com/mayerbalintdev/GYM-One/releases/tag/V1.4.1","https://github.com/mayerbalintdev/GYM-One/security/advisories/GHSA-9j4g-cq35-8997","https://github.com/mayerbalintdev/GYM-One/security/advisories/GHSA-9j4g-cq35-8997"],"products":[],"source":"nvd","synced_at":"2026-10-19T23:00:53.604569364+00:00"},"epss":{"cve":"CVE-2026-55871","score":0.00342,"percentile":0.27454,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}