{"kind": "product", "path": "vulns/pypi/wger", "name": "wger", "product": "wger", "ecosystem": "PyPI", "items": [{"id": "CVE-2026-46438", "noindex": false, "published": "2026-10-07T14:00:10.046Z", "modified": "2026-10-07T18:00:21.494Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "severity": "medium", "epss": 0.00227, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-46438", "title": "wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry", "description": "wger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user's `SlotEntry` by supplying the victim's `slot_entry` ID in a `POST /api/v2/workoutlog/` request. The `slot_entry` foreign key is not included in the ownership verification performed by `WorkoutLogViewSet.get_owner_objects()`, so the server accepts and persists the cross-user reference without error. Because `SlotEntry.get_config_data()` retrieves associated logs via `self.workoutlog_set.all()` with no user filter, the attacker's injected data is silently folded into the victim's ", "references": ["https://github.com/wger-project/wger/security/advisories/GHSA-rjpf-7pf5-q54x", "https://github.com/wger-project/wger/releases/tag/2.6", "https://nvd.nist.gov/vuln/detail/CVE-2026-46438"], "fixes": [], "products": [{"name": "wger", "path": "vulns/pypi/wger", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-46437", "noindex": false, "published": "2026-10-07T13:58:34.529Z", "modified": "2026-10-10T02:24:34.332Z", "cvss": 4.8, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00242, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-46437", "title": "wger: API credentials remain valid after logout/password change", "description": "wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle of `wger` where bearer-style API credentials remain valid after a user logs out and after a user changes their password. An attacker who steals a victim’s DRF authtoken (`Authorization: Token ...`) or JWT refresh token can continue to access protected `/api/v2/*` endpoints until the token is manually rotated/deleted (DRF token) or naturally expires (JWT refresh). Version 2.6 contains a patch.", "references": ["https://github.com/wger-project/wger/security/advisories/GHSA-v3x9-6gg8-c2c9", "https://github.com/wger-project/wger/releases/tag/2.6", "https://nvd.nist.gov/vuln/detail/CVE-2026-46437"], "fixes": [], "products": [{"name": "wger", "path": "vulns/pypi/wger", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-46434", "noindex": false, "published": "2026-10-07T13:55:19.566Z", "modified": "2026-10-07T14:35:38.960Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "severity": "high", "epss": 0.00221, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-46434", "title": "wger: Trainer Privilege Escalation - Improper Privilege Management", "description": "wger is a free, open-source workout and fitness manager. Prior to version 2.6, a user with only the `gym_trainer` permission can deactivate any account in the same gym, including `gym_manager` and `general_gym_manager` accounts. The `UserDeactivateView` grants access to anyone holding any one of `gym.manage_gym`, `gym.manage_gyms`, or `gym.gym_trainer` (OR logic via `WgerMultiplePermissionRequiredMixin`), and performs no privilege-hierarchy check to prevent a lower-privileged role from disabling a higher-privileged one. Version 2.6 fixes the issue.", "references": ["https://github.com/wger-project/wger/security/advisories/GHSA-x249-cx55-2h87", "https://github.com/wger-project/wger/releases/tag/2.6", "https://nvd.nist.gov/vuln/detail/CVE-2026-46434"], "fixes": [], "products": [{"name": "wger", "path": "vulns/pypi/wger", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-45161", "noindex": false, "published": "2026-10-07T13:35:53.363Z", "modified": "2026-10-07T17:04:45.845Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00088, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-45161", "title": "wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding", "description": "wger is a free, open-source workout and fitness manager. Prior to version 2.6, the `trainer_login` view in wger accepts GET requests and executes `django_login()` without any CSRF protection, because Django's `CsrfViewMiddleware` only enforces tokens on unsafe methods (POST/PUT/PATCH/DELETE). An attacker can embed a single `<img>` tag on a malicious page; when an authenticated trainer loads that page, their browser auto-issues the GET with the session cookie, forcibly rebinding the trainer's session to an arbitrary user account. Version 2.6 fixes the issue.", "references": ["https://github.com/wger-project/wger/security/advisories/GHSA-xf64-4pmc-h8qf", "https://github.com/wger-project/wger/releases/tag/2.6", "https://nvd.nist.gov/vuln/detail/CVE-2026-45161"], "fixes": [], "products": [{"name": "wger", "path": "vulns/pypi/wger", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-43976", "noindex": false, "published": "2026-10-07T13:33:11.008Z", "modified": "2026-10-07T17:26:56.782Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "severity": "high", "epss": 0.00219, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-43976", "title": "wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)", "description": "wger is a free, open-source workout and fitness manager. Prior to version 2.6, five gym management views in wger apply a flawed gym-scope guard (`gym_a != gym_b`) that silently passes when both operands are `None`. A trainer with `gym.gym_trainer` and `gym.add_adminusernote` permissions and no gym assignment (`gym=None`) can read private admin notes, uploaded documents, gym contracts, user configuration, and user permission data for **any other unaffiliated user** on the instance. The subsequent querysets filter only on the attacker-supplied `member_id` with no secondary gym-scoped validation, so all records are disclosed. Version 2.6 fixes t", "references": ["https://github.com/wger-project/wger/security/advisories/GHSA-c72h-82w6-rqfp", "https://github.com/wger-project/wger/releases/tag/2.6", "https://nvd.nist.gov/vuln/detail/CVE-2026-43976"], "fixes": [], "products": [{"name": "wger", "path": "vulns/pypi/wger", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-86257", "noindex": false, "published": "2026-09-06T12:00:30.969Z", "modified": "2026-09-08T15:10:52.649Z", "cvss": 4.8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "severity": "medium", "epss": 0.00277, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-86257", "title": "wger before 2.6 CSV Formula Injection via member export", "description": "wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or LibreOffice Calc.", "references": ["https://github.com/wger-project/wger/security/advisories/GHSA-xq9m-hmp9-fw87", "https://www.vulncheck.com/advisories/wger-before-2.6-csv-formula-injection-via-member-export", "https://nvd.nist.gov/vuln/detail/CVE-2026-86257"], "fixes": ["2.6"], "products": [{"name": "wger", "path": "vulns/pypi/wger", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-86256", "noindex": false, "published": "2026-09-06T12:00:30.256Z", "modified": "2026-09-09T13:59:36.446Z", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "severity": "medium", "epss": 0.00234, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-86256", "title": "wger before 2.6 Open Redirect via trainer-login next parameter", "description": "wger before 2.6 (affected versions <= 2.5.0) contains an open redirect vulnerability in the trainer_login view (wger/core/views/user.py). After a trainer enters impersonation mode, the view redirects to the user-supplied 'next' GET parameter via HttpResponseRedirect() without validating it with url_has_allowed_host_and_scheme(). An attacker who delivers a crafted link to an authenticated trainer can redirect the trainer's browser to an attacker-controlled domain, enabling phishing and leaking the wger URL structure (including the impersonated user's user_pk) via the Referer header.", "references": ["https://github.com/wger-project/wger/security/advisories/GHSA-vqv8-j3mj-wjxj", "https://www.vulncheck.com/advisories/wger-before-2.6-open-redirect-via-trainer-login-next-parameter", "https://nvd.nist.gov/vuln/detail/CVE-2026-86256"], "fixes": ["2.6"], "products": [{"name": "wger", "path": "vulns/pypi/wger", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-86255", "noindex": false, "published": "2026-09-06T12:00:29.574Z", "modified": "2026-09-18T17:23:10.370Z", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00436, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-86255", "title": "wger before 2.5 Uncontrolled Resource Consumption via date_sequence", "description": "wger before 2.5 fails to validate the maximum duration of routine date ranges, allowing authenticated users to create routines spanning arbitrarily long periods. Attackers can trigger the date_sequence computation via routine detail endpoints, forcing the server to iterate thousands of times per request and exhaust worker threads, denying service to legitimate users.", "references": ["https://github.com/wger-project/wger/security/advisories/GHSA-v25j-wqcw-fvhj", "https://www.vulncheck.com/advisories/wger-before-2.5-uncontrolled-resource-consumption-via-date-sequence", "https://nvd.nist.gov/vuln/detail/CVE-2026-86255"], "fixes": [], "products": [{"name": "wger", "path": "vulns/pypi/wger", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-43977", "noindex": false, "published": "2026-07-16T22:13:12.238Z", "modified": "2026-07-17T13:14:37.507Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": 0.00289, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-43977", "title": "wger IDOR: Authenticated Users Can Read Others' Private Workout Session Data via Template Routine API", "description": "wger is a free, open-source workout and fitness manager. In versions prior to 2.6, any authenticated user can read another user's private workout session notes, exercise history, and training statistics by calling the /logs/ and /stats/ actions on a routine they do not own. The vulnerability exists in RoutineViewSet (wger/manager/api/views.py). The view defines two custom actions /logs/ and /stats/ that are intended to return data for the requesting user's own training history within a routine. However, the underlying permission check (RoutinePermission.has_object_permission) grants read access to any authenticated user when the routine has i", "references": ["https://github.com/wger-project/wger/security/advisories/GHSA-cj9g-27ph-4cgv", "https://nvd.nist.gov/vuln/detail/CVE-2026-43977"], "fixes": [], "products": [{"name": "wger", "path": "vulns/pypi/wger", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-43978", "noindex": false, "published": "2026-07-16T22:11:57.629Z", "modified": "2026-07-17T10:49:37.286Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.00265, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-43978", "title": "wger: Privilege escalation via trainer-login session chaining allows gym trainers to impersonate gym managers", "description": "wger is a free, open-source workout and fitness manager. In versions prior to 2.6, a gym trainer can escalate their session to any higher-privileged account (gym manager, general manager) by chaining two calls to the trainer-login endpoint. Once a trainer performs a legitimate switch into a low-privileged user, the session flag trainer.identity is set and this flag alone bypasses the permission check on all subsequent trainer-login calls. This grants full gym administration capabilities including viewing all member data, modifying contracts, managing gym configuration, and accessing other trainers' and managers' personal information. This iss", "references": ["https://github.com/wger-project/wger/security/advisories/GHSA-9qpr-vc49-hqg2", "https://nvd.nist.gov/vuln/detail/CVE-2026-43978"], "fixes": [], "products": [{"name": "wger", "path": "vulns/pypi/wger", "ecosystem": "PyPI"}]}, {"id": "GHSA-mw8f-w6p8-xrf4", "noindex": false, "published": "2026-05-20T15:37:26Z", "modified": "2026-05-20T15:45:44.941558592Z", "cvss": 8.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/ghsa-mw8f-w6p8-xrf4", "title": "wger: cross-tenant account deletion / deactivation / activation by gym.manage_gym + gym=None", "description": "## Summary\n\nGHSA-mhc8-p3jx-84mm (CVE-2026-43948) reported that wger's `reset_user_password` and `gym_permissions_user_edit` views in `wger/gym/views/user.py` performed a gym-scope authorization check using Django ORM object comparison (`if request.user.userprofile.gym != user.userprofile.gym`) which silently passes when both sides are `None` (`None != None` evaluates to `False`). The maintainer's suggested patch (\"Apply the same `same_gym()` helper pattern to all five views sharing this check\") replaces every `userprofile.gym !=` site with the new `is_same_gym()` helper that explicitly excludes `None` (`gym_a is not None and gym_a == gym_b`).", "references": ["https://github.com/wger-project/wger/security/advisories/GHSA-mw8f-w6p8-xrf4", "https://github.com/wger-project/wger", "https://osv.dev/vulnerability/GHSA-mw8f-w6p8-xrf4"], "fixes": [], "products": [{"name": "wger", "path": "vulns/pypi/wger", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-43948", "noindex": false, "published": "2026-05-12T20:47:23.906Z", "modified": "2026-05-13T14:50:46.717Z", "cvss": 9.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "severity": "critical", "epss": 0.00371, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-43948", "title": "wger: cross-tenant password reset and plaintext disclosure via gym=None bypass", "description": "wger is a free, open-source workout and fitness manager. Prior to 2.6, the reset_user_password and gym_permissions_user_edit views in wger perform a gym-scope authorization check using Python object comparison (!=) that evaluates None != None as False, silently bypassing the guard when both the attacker and victim have no gym assignment (gym=None). A user with gym.manage_gym permission and gym=None can reset the password of any other gym=None user; the new plaintext password is returned verbatim in the HTML response body, enabling one-shot full account takeover. The victim's original password is invalidated, locking them out permanently. This", "references": ["https://github.com/wger-project/wger/security/advisories/GHSA-mhc8-p3jx-84mm", "https://nvd.nist.gov/vuln/detail/CVE-2026-43948"], "fixes": ["2.6"], "products": [{"name": "wger", "path": "vulns/pypi/wger", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-40474", "noindex": false, "published": "2026-04-17T21:39:03.677Z", "modified": "2026-04-20T16:08:12.427Z", "cvss": 7.6, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L", "severity": "high", "epss": 0.00333, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-40474", "title": "wger has Broken Access Control in the Global Gym Configuration Update Endpoint", "description": "wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the GymConfigUpdateView declares permission_required = 'config.change_gymconfig' but inherits WgerFormMixin instead of WgerPermissionMixin, so the permission is never enforced at runtime. Since GymConfig is an ownerless singleton, any authenticated user can modify the global gym configuration, triggering save() side effects that bulk-update user profile gym assignments — a vertical privilege escalation to installation-wide configuration control. This issue is fixed in version 2.5.", "references": ["https://github.com/wger-project/wger/security/advisories/GHSA-xppv-4jrx-qf8m", "https://github.com/wger-project/wger/commit/47ee5af93b3ced24b9f94b0a8b9296b50bc9523f", "https://github.com/wger-project/wger/releases/tag/2.5"], "fixes": [], "products": [{"name": "wger", "path": "vulns/pypi/wger", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-40353", "noindex": false, "published": "2026-04-17T21:16:12.401Z", "modified": "2026-04-20T16:17:52.305Z", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "severity": "medium", "epss": 0.00207, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-40353", "title": "wger: Stored XSS via Unescaped License Attribution Fields", "description": "wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the attribution_link property in AbstractLicenseModel constructs HTML by directly interpolating user-controlled license fields (such as license_author) without escaping, and templates render the result using Django's |safe filter. An authenticated user can create an ingredient with a malicious license_author value containing JavaScript, which executes in the browser of any visitor viewing the ingredient page, resulting in stored XSS. This issue has been fixed in version 2.5.", "references": ["https://github.com/wger-project/wger/security/advisories/GHSA-6f54-qjvm-wwq3", "https://github.com/wger-project/wger/releases/tag/2.5", "https://nvd.nist.gov/vuln/detail/CVE-2026-40353"], "fixes": [], "products": [{"name": "wger", "path": "vulns/pypi/wger", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-27839", "noindex": false, "published": "2026-02-26T22:07:43.640Z", "modified": "2026-03-03T01:36:50.202Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00304, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-27839", "title": "wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup", "description": "wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, three `nutritional_values` action endpoints fetch objects via `Model.objects.get(pk=pk)` — a raw ORM call that bypasses the user-scoped queryset. Any authenticated user can read another user's private nutrition plan data, including caloric intake and full macro breakdown, by supplying an arbitrary PK. Commit 29876a1954fe959e4b58ef070170e81703dab60e contains a fix for the issue.", "references": ["https://github.com/wger-project/wger/security/advisories/GHSA-g8gc-6c4h-jg86", "https://github.com/wger-project/wger/commit/29876a1954fe959e4b58ef070170e81703dab60e", "https://nvd.nist.gov/vuln/detail/CVE-2026-27839"], "fixes": [], "products": [{"name": "wger", "path": "vulns/pypi/wger", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-27838", "noindex": false, "published": "2026-02-26T22:04:57.968Z", "modified": "2026-03-03T01:37:38.975Z", "cvss": 3.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "severity": "low", "epss": 0.00294, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-27838", "title": "wger: IDOR via user-unscoped cache keys on routine API actions exposes workout data", "description": "wger is a free, open-source workout and fitness manager. Five routine detail action endpoints check a cache before calling `self.get_object()`. In versions up to and including 2.4, ache keys are scoped only by `pk` — no user ID is included. When a victim has previously accessed their routine via the API, an attacker can retrieve the cached response for the same PK without any ownership check. Commit e964328784e2ee2830a1991d69fadbce86ac9fbf contains a patch for the issue.", "references": ["https://github.com/wger-project/wger/security/advisories/GHSA-42cr-w2gr-m54q", "https://github.com/wger-project/wger/commit/e964328784e2ee2830a1991d69fadbce86ac9fbf", "https://nvd.nist.gov/vuln/detail/CVE-2026-27838"], "fixes": [], "products": [{"name": "wger", "path": "vulns/pypi/wger", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-27835", "noindex": false, "published": "2026-02-26T22:00:23.768Z", "modified": "2026-03-03T01:38:18.118Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00295, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-27835", "title": "wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data", "description": "wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, `RepetitionsConfigViewSet` and `MaxRepetitionsConfigViewSet` return all users' repetition config data because their `get_queryset()` calls `.all()` instead of filtering by the authenticated user. Any registered user can enumerate every other user's workout structure. Commit 1fda5690b35706bb137850c8a084ec6a13317b64 contains a fix for the issue.", "references": ["https://github.com/wger-project/wger/security/advisories/GHSA-xf68-8hjw-7mpm", "https://github.com/wger-project/wger/commit/1fda5690b35706bb137850c8a084ec6a13317b64", "https://nvd.nist.gov/vuln/detail/CVE-2026-27835"], "fixes": [], "products": [{"name": "wger", "path": "vulns/pypi/wger", "ecosystem": "PyPI"}]}, {"id": "CVE-2023-38759", "noindex": false, "published": "2023-08-08T00:00:00.000Z", "modified": "2024-10-10T19:00:13.668Z", "cvss": 8.8, "cvss_vector": "", "severity": "high", "epss": 0.00402, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2023-38759", "title": "CVE-2023-38759", "description": "Cross Site Request Forgery (CSRF) vulnerability in wger Project wger Workout Manager 2.2.0a3 allows a remote attacker to gain privileges via the user-management feature in the gym/views/gym.py, templates/gym/reset_user_password.html, templates/user/overview.html, core/views/user.py, and templates/user/preferences.html, core/forms.py components.", "references": ["https://wger.de", "https://github.com/0x72303074/CVE-Disclosures", "https://nvd.nist.gov/vuln/detail/CVE-2023-38759"], "fixes": [], "products": [{"name": "wger", "path": "vulns/pypi/wger", "ecosystem": "PyPI"}, {"name": "wger", "path": "vulns/pypi/wger", "ecosystem": "PyPI"}]}, {"id": "CVE-2023-38758", "noindex": false, "published": "2023-08-08T00:00:00.000Z", "modified": "2024-10-10T18:53:47.335Z", "cvss": 5.4, "cvss_vector": "", "severity": "medium", "epss": 0.00586, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2023-38758", "title": "CVE-2023-38758", "description": "Cross Site Scripting vulnerability in wger Project wger Workout Manager v.2.2.0a3 allows a remote attacker to gain privileges via the license_author field in the add-ingredient function in the templates/ingredients/view.html, models/ingredients.py, and views/ingredients.py components.", "references": ["https://wger.de", "https://github.com/0x72303074/CVE-Disclosures", "https://nvd.nist.gov/vuln/detail/CVE-2023-38758"], "fixes": [], "products": [{"name": "wger", "path": "vulns/pypi/wger", "ecosystem": "PyPI"}, {"name": "wger", "path": "vulns/pypi/wger", "ecosystem": "PyPI"}]}, {"id": "CVE-2022-2650", "noindex": false, "published": "2022-11-24T00:00:00.000Z", "modified": "2025-04-25T18:11:17.130Z", "cvss": 7.8, "cvss_vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00712, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2022-2650", "title": "Improper Restriction of Excessive Authentication Attempts in wger-project/wger", "description": "Improper Restriction of Excessive Authentication Attempts in GitHub repository wger-project/wger prior to 2.2.", "references": ["https://huntr.dev/bounties/f0d85efa-4e78-4b1d-848f-edea115af64b", "https://github.com/wger-project/wger/commit/5e3167e3a2dc95836fa2607fe201524c031a2c4c", "https://nvd.nist.gov/vuln/detail/CVE-2022-2650"], "fixes": ["2.2"], "products": [{"name": "wger", "path": "vulns/pypi/wger", "ecosystem": "PyPI"}]}], "total": 20, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "wger", "path": "vulns/pypi/wger", "ecosystem": "PyPI"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 5, "kev": 0}, "lastmod": "2026-10-10T02:24:34.332Z", "early_advisories": [], "license": "Подборку PatchFirst и наши дополнения (приоритеты, ранние предупреждения, тексты, сводки и агрегаты) можно свободно использовать для собственных целей, включая внутренние задачи бизнеса. Перепродажа, коммерческое распространение и массовое зеркалирование этой подборки или дополнений допускаются только по письменному соглашению с оператором. При любом использовании или публикации подборки или наших дополнений указывайте PatchFirst (https://ru.patchfirst.dev/vulns/) с этой ссылкой на страницу ленты своего региона. Исходные записи открытых источников остаются под их лицензиями и условиями. Эти условия не ограничивают ваши права на исходные данные, которые можно получить у источников напрямую.", "terms_url": "https://ru.patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://ru.patchfirst.dev/vulns/"}, "source_changes": "PatchFirst отбирает, нормализует и объединяет записи; могут добавляться сводки и переводы. Новости указываются ссылкой на первоисточник в самой записи.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Лицензии исходных баз различаются; см. каталог источников."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Оценки доступны свободно; запрашивается указание источника (FIRST EPSS, оценки подготовлены Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}