wger vulnerabilities (PyPI)
20 vulnerabilities.
-
wgerPyPI wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry 6.5 Medium -
wgerPyPI wger: API credentials remain valid after logout/password change 4.8 Medium -
wgerPyPI wger: Trainer Privilege Escalation - Improper Privilege Management 7.1 High -
wgerPyPI wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding 5.4 Medium -
wgerPyPI wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views) 7.1 High -
wgerPyPI wger: cross-tenant account deletion / deactivation / activation by gym.manage_gym + gym=None 8.5 High -
wgerPyPI wger: Privilege escalation via trainer-login session chaining allows gym trainers to impersonate gym managers 8.1 High -
wgerPyPI wger IDOR: Authenticated Users Can Read Others' Private Workout Session Data via Template Routine API 7.5 High -
wgerPyPI wger before 2.5 Uncontrolled Resource Consumption via date_sequence 7.1 High -
wgerPyPI wger before 2.6 Open Redirect via trainer-login next parameter 5.1 Medium -
wgerPyPI wger: cross-tenant password reset and plaintext disclosure via gym=None bypass 9.9 Critical -
wgerPyPI wger before 2.6 CSV Formula Injection via member export 4.8 Medium -
wgerPyPI wger: Stored XSS via Unescaped License Attribution Fields 5.1 Medium -
wgerPyPI wger has Broken Access Control in the Global Gym Configuration Update Endpoint 7.6 High -
wgerPyPI wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup 4.3 Medium -
wgerPyPI wger: IDOR via user-unscoped cache keys on routine API actions exposes workout data 3.1 Low -
wgerPyPI wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data 4.3 Medium -
wgerPyPI wger Workout Manager Cross-Site Request Forgery vulnerability 8.8 High -
wgerPyPI wger Workout Manager Cross-site Scripting vulnerability 5.4 Medium -
wgerPyPI Improper Restriction of Excessive Authentication Attempts in wger-project/wger 7.8 High