Repository navigation
🚨 GYM One v1.4.1 – LOCKDOWN
Release Date: 2026 June 15, 18:45
Version: V1.4.1
🌍 Summary
Update V1.4.1 – codename LOCKDOWN is an emergency security release focused on patching critical vulnerabilities discovered during internal security testing. This update strengthens GYM One’s protection against malicious input and significantly improves overall platform security.
🆕 What's new in v1.4.1:
🛡️ Critical Security Fix
SQL Injection Vulnerability Patched
A critical vulnerability was identified in the member search system where user input could directly alter SQL queries. This could potentially allow unauthorized database access through crafted search payloads.
The search system now uses prepared statements, ensuring all user input is treated strictly as data and never as executable SQL.
🛡️ Critical Security Fix
Stored XSS Vulnerability Patched
A stored XSS vulnerability was found in profile-related fields such as member names and email addresses. Malicious scripts could previously execute inside admin pages if unsafe input was saved.
All user-generated output is now properly sanitized using htmlspecialchars(), preventing scripts from executing in the browser.
⚡ Improvement
Improved Input Sanitization
Additional validation and sanitization improvements have been applied across critical user-facing areas to strengthen protection against malicious payloads.
⚡ Improvement
Enhanced Security Layer
This update reinforces GYM One’s core security architecture and improves resilience against common web attack vectors.
🚀 Security comes first — stronger protection and safer infrastructure with GYM One v1.4.1 LOCKDOWN.