The vulnerability exists in the admin users list display, where first name, last name, and email fields are rendered without any HTML encoding. Based on the description, it is inferred that an attacker who has the ability to store malicious data in these profile fields can inject persistent script that executes in the administrator's browser each time the list page is viewed. This allows the attacker to steal session tokens, perform actions with administrator privileges, or otherwise compromise the system until the corrupt record is removed. The weakness is a classic Stored XSS flaw (CWE‑79).

The affected product is GYM One, an open‑source gym management system from Mayerbalintdev. Versions prior to 1.4.1 are impacted, as the flaw is fixed in that release.

The CVSS score of 8.7 marks it as high severity, indicating a serious threat if exploited. The EPSS score is less than 1%, suggesting a low probability of exploitation at present and it is not listed in the CISA KEV catalog. The likely attack vector requires an attacker with the ability to modify stored profile information such as through an authenticated user's input or a separate injection vulnerability. Once the malicious content is stored, any administrator who visits the user list page will trigger the execution, giving the attacker persistent access until the stored data is cleaned.