---
id: CVE-2026-55871
title: >-
  GYM One is open-source gym management software for fitness centers, personal
  trainers, and sports clubs
summary: >-
  GYM One is open-source gym management software for fitness centers, personal
  trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php
  concatenates the search_name and search_email GET parameters into both the
  user-list…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-89
vendor: mayerbalintdev
product: GYM-One
affected:
  - GYM-One < 1.4.1
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T19:17:41.150'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55871'
references:
  - url: >-
      https://github.com/mayerbalintdev/GYM-One/commit/d3a0cf134f0ab3ac12aee7dca283b93c4290dcc4
    label: security-advisories@github.com
  - url: 'https://github.com/mayerbalintdev/GYM-One/releases/tag/V1.4.1'
    label: security-advisories@github.com
  - url: >-
      https://github.com/mayerbalintdev/GYM-One/security/advisories/GHSA-9j4g-cq35-8997
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
  - exploit-available
ingestedAt: '2026-10-15T19:25:46.436Z'
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T19:53:28.154937Z'
---

## Overview

GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php concatenates the search_name and search_email GET parameters into both the user-list query and the COUNT query used for pagination without prepared statements. An authenticated administrator can inject SQL through either search field to read data from arbitrary tables, including user information and password hashes. Depending on database permissions, the same injection may also permit filesystem writes. This issue is fixed in version 1.4.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.