Skip to content
OpenAdvisories

Vendor

CodeWithCJ

3 known vulnerabilities.

Products

SparkyFitness 3
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-113612

    SparkyFitness before 0.17.0 Missing Authorization via food-variants DELETE Endpoint

    SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from public food read endpoints…

    CodeWithCJ SparkyFitness
  • Medium 5.4
    CVE-2026-102923

    SparkyFitness: SSRF via unvalidated custom_url in AI service settings

    SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, SparkyFitnessServer/services/chatService.ts and SparkyFitnessServer/services/labelScanService.ts do not validate destinations supplied in custom AI service set…

    CodeWithCJ SparkyFitness