Codewithcj Sparkyfitness vulnerabilities
- codewithcj sparkyfitnessSparkyFitness before 0.17.0 Missing Authorization via food-variants DELETE Endpoint5.3 Medium
- codewithcj sparkyfitnessSparkyFitness: SSRF via unvalidated custom_url in AI service settings5.4 Medium
- codewithcj sparkyfitnessSparkyFitness: Authenticated OS command injection (host RCE) via backup-restore filename in POST /api/admin/backup/restore7.2 High
- codewithcj sparkyfitnessSparkyFitness v0.15.8.2 is vulnerable to Cross Site Scripting (XSS) via user input and LLM output.6.1 Medium