A reflected XSS flaw exists in the reservation endpoint of the IsMyGym application where the user‑supplied 'ret' parameter is echoed in the HTML response without sanitization. Exploitation allows an attacker to inject and run arbitrary JavaScript code in the victim’s browser, potentially leading to credential theft or session hijacking.

Zuinq Studio’s Gym Management Software IsMyGym is affected. The issue exists in all versions prior to v6.0.85; the vulnerability was addressed in the v6.0.85 release.

The CVSS base score of 5.1 indicates a moderate severity for this client‑side vulnerability. Since the EPSS score is not available and the flaw is not listed in the CISA KEV catalog, the documented likelihood of exploitation is uncertain. The attack vector is likely remote via a crafted URL sent to the victim; successful exploitation would occur when the victim clicks the malicious link and the injected script executes within their browser context.