CVE-2026-55871

Name of the Vulnerable Software and Affected Versions GYM One versions prior to 1.4.1

Description An authenticated administrator can perform SQL injection via the 'admin/users/index.php' endpoint. The issue occurs because the search name and search email GET parameters are concatenated into the user-list and pagination COUNT queries without the use of prepared statements. This allows an attacker to read data from arbitrary tables, such as user information and password hashes, and may permit filesystem writes depending on database permissions.

Recommendations Update to version 1.4.1. Avoid using the search name and search email parameters in the 'admin/users/index.php' endpoint until the update is applied.